b905517ca9
22 changes to exploits/shellcodes/ghdb Spring Boot common-user-management 0.1 - Remote Code Execution (RCE) ABB Cylon Aspect 3.07.02 (userManagement.php) - Weak Password Policy ABB Cylon Aspect 3.08.02 (bbmdUpdate.php) - Remote Code Execution ABB Cylon Aspect 3.08.02 (licenseServerUpdate.php) - Stored Cross-Site Scripting ABB Cylon Aspect 3.08.02 (licenseUpload.php) - Stored Cross-Site Scripting ABB Cylon Aspect 3.08.02 (uploadDb.php) - Remote Code Execution ABB Cylon Aspect 3.08.02 - Cookie User Password Disclosure ABB Cylon Aspect 3.08.03 (CookieDB) - SQL Injection Ivanti Connect Secure 22.7R2.5 - Remote Code Execution (RCE) ABB Cylon Aspect 3.08.03 (MapServicesHandler) - Authenticated Reflected XSS ABB Cylon Aspect 3.08.03 - Hard-coded Secrets Adapt Authoring Tool 0.11.3 - Remote Command Execution (RCE) IBMi Navigator 7.5 - HTTP Security Token Bypass IBMi Navigator 7.5 - Server Side Request Forgery (SSRF) Plane 0.23.1 - Server side request forgery (SSRF) ABB Cylon Aspect 3.08.02 (escDevicesUpdate.php) - Denial of Service (DOS) ABB Cylon Aspect 3.08.02 (webServerUpdate.php) - Input Validation Config Poisoning Cacti 1.2.26 - Remote Code Execution (RCE) (Authenticated) OpenCMS 17.0 - Stored Cross Site Scripting (XSS) Really Simple Security 9.1.1.1 - Authentication Bypass Pymatgen 2024.1 - Remote Code Execution (RCE)
42 lines
No EOL
1.5 KiB
Text
42 lines
No EOL
1.5 KiB
Text
# Exploit Title: OpenCMS 17.0 - Stored Cross Site Scripting (XSS)
|
|
# Date: 24-11-2024
|
|
# Exploit Author: Siddhartha Naik
|
|
# Vendor Homepage: http://www.opencms.org/en/
|
|
# Software Link: http://www.opencms.org/en/modules/downloads/begindownload.html?id=dade528f-ec17-11ee-ab97-7fde8b0295e1
|
|
# Affected Version: 17.0
|
|
# Category: WebApps
|
|
# Tested on: Windows 11
|
|
# CVE : CVE-2024-41447
|
|
|
|
1. Vendor Description:
|
|
|
|
OpenCms from Alkacon Software is a professional, easy to use website
|
|
content management system. OpenCms helps content managers worldwide to
|
|
create and maintain beautiful websites fast and efficiently.
|
|
|
|
2. Technical Description:
|
|
|
|
This is a Stored XSS vulnerability in the author field seen when publishing an article.
|
|
This vulnerability has been tested on latest versions of Brave and Firefox browsers.
|
|
It is believed to affect any user who clicks on the "Read More" button of the affected article and
|
|
can be exploited by any user who is able to modify/create articles.
|
|
|
|
3. Proof Of Concept:
|
|
|
|
a) Start by creating a new article. In the author field write your script like so:
|
|
|
|
<script>alert(1)</script>
|
|
|
|
b) Save and publish the article
|
|
c) The user who clicks on the read more button gets a popup saying '1'
|
|
|
|
4. Solution:
|
|
|
|
Upgrade to latest release.
|
|
http://www.opencms.org/en/home/news.html
|
|
|
|
5. Reference:
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41447
|
|
https://github.com/Sidd545-cr/CVE/blob/main/CVE-2024-41447%20-%20Stored%20XSS%20in%20author%20field.pdf
|
|
http://alkacon.com
|
|
http://opencms.com |