Mara CMS 7.5 - Reflective Cross-Site Scripting

ID: 103287
CVE: None
Download vulnerable application: None
# Exploit Title: 
# Google Dork: NA
# Date: 2020-08-01
# Exploit Author: George Tsimpidas
# Vendor Homepage:
# Software Link:
# Version: 7.5
# Tested on: Kali Linux(x64)
# CVE : CVE-2020-24223

Mara CMS 7.5 suffers from a Reflected Cross Site Scripting vulnerability.

Description :

 This Reflected XSS vulnerability allows any authenticated user to
inject malicious code via the parameter contact.php?theme=<inject>.
The vulnerability exists because the parameter is not properly
sanitized and this can lead to malicious code injection that will be
executed on the target’s browser.

PoC :

Use Payload : seven69387';alert(1)//154

Path : http://localhost/contact.php?theme=< inject payload here>

Injection Example :
1-4-2 (www01)