Textpattern 4.9.0 Cross Site Scripting

Textpattern 4.9.0, a content management system, was affected by a Textpattern 4.9.0, a content management system, was affected by a Cross-Site Scripting (XSS) vulnerability. This flaw typically arose from insufficient sanitization of user-supplied input in various administrative interfaces or content fields.

An attacker could inject malicious client-side scripts into, for instance, article titles, custom fields, or other areas that were not properly escaped upon rendering. When an authenticated user (e.g., an administrator) viewed the compromised content, the injected script would execute within their browser.

This allowed for potential session hijacking, unauthorized actions performed in the victim's context, or defacement. Users were advised to upgrade to Textpattern 4.9.1 or later versions to mitigate this security risk.

# Exploit Title: Textpattern CMS 4.9.0 - Stored Cross-Site Scripting (XSS)
in Preferences
# Date: 2025-12-22
# Exploit Author: tmrswrr
# Vendor Homepage: https://textpattern.com/
# Software Link:
https://textpattern.com/file_download/124/textpattern-4.9.0.zip
# Version: 4.9.0
# Tested on: Apache/2.4.65, PHP 7.4.33, MariaDB 10.5.28


## Description:
Textpattern CMS version 4.9.0 contains a stored Cross-Site Scripting (XSS)
vulnerability in the administrative interface. The vulnerability allows
authenticated attackers with administrative privileges to inject malicious
JavaScript payloads into site preferences ( "Site URL" field ), which are
then executed when any user visits the frontend of the website.


## Proof of Concept:

### Step 1: Login to Admin Panel
1. Navigate to: `http://target.com/textpattern/`
2. Login with administrator credentials (default: admin/password)

### Step 2: Access Preferences
1. Click on "Admin" in the top navigation
2. Select "Preferences" from the dropdown menu
3. Navigate to the "Site" tab

### Step 3: Inject XSS Payload
In the "Site URL" field, insert the XSS payload:

"><script>alert('1');</script>