Hello there,

I just discovered multiple Stored XSS vulnerabilities in CMSMS Admin Console
which lie in the "Settings - Content Manager" page under "Site Admin" option in
the sidebar menu.

Reproduction Steps:
Step 1. Login to the Admin Console.
Step 2. Click on Site Admin and then click on "Settings - Content Manager", and
then go to the "New Page Defaults" tab.
Step 3. Insert the following payload in the two "textarea" elements; "Metadata"
and "Default Content":
</textarea><svg/onload=alert(document.domain)>
Step 4. Insert the following payload in the three "input type='text'" elements;
"Extra1 Field value", "Extra2 Field value" and "Extra3 Field Value":
"><svg/onload=alert(document.cookie)>
Step 5. Now, click on the "Submit" button.

You should now be able to see 5 alert prompts appearing one by one, as a result
of the 5 payloads being executed.

I am looking forward to seeing these vulnerabilities getting patched soon in the
next release of CMS Made Simple.

This vulnerability is reproducible in the latest version; 2.2.14 and below.

It can be patched by properly implementing sanitization and filtering related
functions in PHP for the form values in the page.

Thanks,
Binit Ghimire