A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Registration Number parameter.
cpe:2.3:a:eyoucms:eyoucms:1.6.5-utf8-sp1:*:*:*:*:*:*:*
920C4179-21B4-4BEC-AC3C-8C7530C41B13
OR
Version : V1.6.5
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/ac2e0f3e-ae29-4847-bee5-ba5cdc9213ab)

Vulnerability point 1:
"基本信息"->"备案号"&“公安备案号”->"代码模式",HTML code can be edited directly：
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/b0ba7efa-fb46-439d-b188-43294602b112)
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/080141d7-9671-4acf-8cc0-df0d26f05489)

Vulnerability point 2:
“广告管理”：
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/4bc8ee69-731b-447e-9ac5-38023276453a)
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/c0e66524-bdf7-4101-9b5c-098e9dbac699)

Vulnerability point 3:
In rich text editing, the front end will automatically add http to the hyperlink, but it can be bypassed by capturing the packet：
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/080d379a-d187-4e23-8437-28def826a97e)

Delete http://
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/945b00b7-32b5-4a8d-a06c-b16e08c3ac45)
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/f430c71c-d4cb-480a-9c91-b3deed6d0ab9)


EyouCMS-V1.6.5-UTF8-SP1 has a stored XSS vulnerability
This is a GitHub Issue
repo:eyoucms
owner:weng-xianhu
Title : EyouCMS-V1.6.5-UTF8-SP1 has a stored XSS vulnerability
Issue date:

--- start body ---
Version : V1.6.5
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/ac2e0f3e-ae29-4847-bee5-ba5cdc9213ab)

Vulnerability point 1:
"基本信息"->"备案号"&“公安备案号”->"代码模式",HTML code can be edited directly：
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/b0ba7efa-fb46-439d-b188-43294602b112)
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/080141d7-9671-4acf-8cc0-df0d26f05489)

Vulnerability point 2:
“广告管理”：
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/4bc8ee69-731b-447e-9ac5-38023276453a)
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/c0e66524-bdf7-4101-9b5c-098e9dbac699)

Vulnerability point 3:
In rich text editing, the front end will automatically add http to the hyperlink, but it can be bypassed by capturing the packet：
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/080d379a-d187-4e23-8437-28def826a97e)

Delete http://
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/945b00b7-32b5-4a8d-a06c-b16e08c3ac45)
![image](https://github.com/weng-xianhu/eyoucms/assets/92859218/f430c71c-d4cb-480a-9c91-b3deed6d0ab9)


--- end body ---

comments :
--- start comments ---

--- end comments ---