f449a4864b
8 changes to exploits/shellcodes TotalAV 5.15.69 - Unquoted Service Path Simple Attendance System 1.0 - Unauthenticated Blind SQLi Filerun 2021.03.26 - Remote Code Execution (RCE) (Authenticated) e107 CMS 2.3.0 - Remote Code Execution (RCE) (Authenticated) OpenCats 0.9.4-2 - 'docx ' XML External Entity Injection (XXE) Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected) Sentry 8.2.0 - Remote Code Execution (RCE) (Authenticated) Online Reviewer System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
14 lines
No EOL
425 B
Text
14 lines
No EOL
425 B
Text
# Exploit Title: Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected)
|
||
# Date: 10.06.2021
|
||
# Exploit Author: Akıner Kısa
|
||
# Vendor Homepage: https://cloudron.io
|
||
# Software Link: https://www.cloudron.io/get.html
|
||
# Version: 6.3 >
|
||
# CVE : CVE-2021-40868
|
||
|
||
|
||
Proof of Concept:
|
||
|
||
1. Go to https://localhost/login.html?returnTo=
|
||
2. Type your payload after returnTo=
|
||
3. Fill in the login information and press the sign in button. |