Total.js CMS 12 Widget JavaScript Code Injection

Posted on 22 October 2019

This Metasploit module exploits a vulnerability in Total.js CMS. The issue is that a user with admin permission can embed a malicious JavaScript payload in a widget, which is evaluated server side, and gain remote code execution.