VideoLAN VLC Media Player Web Interface 2.2.1 – Metadata Title Cross-Site Scripting

• Exploit Database
• 39 阅读

• 作者： Andrea Sindoni
  日期： 2015-11-16
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/38706/

• ##################################
  # Andrea Sindoni - @invictus1306 #
  ##################################
  
  XSS vulnerability via metadata
  
  1. Introduction
  
  Affected Product:VLC 2.2.1 / WEB INTERFACE
  Vulnerability Type:XSS
  
  2. Vulnerability Description
  
  XSS vulnerability via metadata title 
  
  3. Proof of Concept
  
  3.1 Launch: vlc.exe --http-host=127.0.0.1 --http-port=8080 --http-password=andrea
  3.2 Open Browser and go to localhost:8080 (for more info see https://wiki.videolan.org/Documentation:Modules/http_intf/)
  3.3 Then left username blank and password andrea
  3.4 Select poc.mp3 (attached) file
  3.5 See Attached image
  
  Proof of Concept:
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38706.zip