A cross-site scripting (XSS) vulnerability in EyouCMS V1.5.9-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Record Number text field.
cpe:2.3:a:eyoucms:eyoucms:1.5.9:*:*:*:*:*:*:*
42A15197-E862-429C-8ECB-79D0B850C9C5
OR
Version：V1.5.9-UTF8-SP1
![图片1](https://user-images.githubusercontent.com/83074322/198816360-bae5d187-3aeb-4d61-be73-3c1d333fde57.png)
1、Go to the background --> basic information--> the record number and public security record number, and click the code mode to modify to the code mode.
![图片2](https://user-images.githubusercontent.com/83074322/198816384-f76ee49d-6d3b-4fec-bf08-84d4fc218268.png)
2、Construct the JS script at the record number.
![图片3](https://user-images.githubusercontent.com/83074322/198816435-293df216-7c2a-4538-a113-e2607ac4d7d9.png)
3、Open the EyouCMS client.
![图片4](https://user-images.githubusercontent.com/83074322/198816453-811714f6-a955-42cc-b4b2-032263d84b6c.png)
4、Construct JS scripts on the PC side of the computer under the third-party code of the website.
![图片5](https://user-images.githubusercontent.com/83074322/198816477-b262a20d-155f-4d4d-b089-861b244d1fd1.png)
5、Open the EyouCMS client.
![图片6](https://user-images.githubusercontent.com/83074322/198816487-e75cc6a6-e410-49c5-b858-0dcc3d7700d5.png)
6、Cross-site scripting attacks (XSS) also exist on mobile phones under the public security record number and third-party code of the website and Copyright Information.And the javascript in the copyright information will affect both the foreground and the administrator background.
![图片7](https://user-images.githubusercontent.com/83074322/198827435-e450493d-a055-4224-bfe3-6bb5006d6fcb.png)


EyouCMS v1.5.9 has multiple vulnerabilities, stored cross-site scripting (XSS)
This is a GitHub Issue
repo:eyoucms
owner:weng-xianhu
Title : EyouCMS v1.5.9 has multiple vulnerabilities, stored cross-site scripting (XSS)
Issue date:

--- start body ---
Version：V1.5.9-UTF8-SP1
![图片1](https://user-images.githubusercontent.com/83074322/198816360-bae5d187-3aeb-4d61-be73-3c1d333fde57.png)
1、Go to the background --> basic information--> the record number and public security record number, and click the code mode to modify to the code mode.
![图片2](https://user-images.githubusercontent.com/83074322/198816384-f76ee49d-6d3b-4fec-bf08-84d4fc218268.png)
2、Construct the JS script at the record number.
![图片3](https://user-images.githubusercontent.com/83074322/198816435-293df216-7c2a-4538-a113-e2607ac4d7d9.png)
3、Open the EyouCMS client.
![图片4](https://user-images.githubusercontent.com/83074322/198816453-811714f6-a955-42cc-b4b2-032263d84b6c.png)
4、Construct JS scripts on the PC side of the computer under the third-party code of the website.
![图片5](https://user-images.githubusercontent.com/83074322/198816477-b262a20d-155f-4d4d-b089-861b244d1fd1.png)
5、Open the EyouCMS client.
![图片6](https://user-images.githubusercontent.com/83074322/198816487-e75cc6a6-e410-49c5-b858-0dcc3d7700d5.png)
6、Cross-site scripting attacks (XSS) also exist on mobile phones under the public security record number and third-party code of the website and Copyright Information.And the javascript in the copyright information will affect both the foreground and the administrator background.
![图片7](https://user-images.githubusercontent.com/83074322/198827435-e450493d-a055-4224-bfe3-6bb5006d6fcb.png)


--- end body ---

comments :
--- start comments ---

--- end comments ---