Kirby CMS 2.5.12 – Cross-Site Scripting

• Exploit Database
• 96 阅读

• 作者： Zaran Shaikh
  日期： 2018-07-23
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/45068/

• # Exploit Title:​​ Kirby CMS 2.5.12 - Cross-Site Scripting
  # Date: 2018-07-22
  # Exploit Author: Zaran Shaikh
  # Version: ​2.5.12
  # CVE :​NA
  # Category: ​Web Application
  
  # Description
  # The application allows user injected payload which can lead to Stored
  # Cross Site Scripting.
  
  # Proof of Concept
  # 1. Visit the application as low priv user
  # 2. Go to add page option
  # 3. Under title, enter any XSS payload like:
  
  <script>alert("XSS");</script>
  
  # 4. Upon the payload being injected, the subsequent page is triggered
  # with XSS
  

  Python

  Copy