0f3d104e83
15 changes to exploits/shellcodes/ghdb ZTE ZXHN H168N 3.1 - Remote Code Execution (RCE) via authentication bypass GestioIP 3.5.7 - Cross-Site Request Forgery (CSRF) GestioIP 3.5.7 - Cross-Site Scripting (XSS) GestioIP 3.5.7 - Reflected Cross-Site Scripting (Reflected XSS) GestioIP 3.5.7 - Remote Command Execution (RCE) GestioIP 3.5.7 - Stored Cross-Site Scripting (Stored XSS) OpenPanel 0.3.4 - Directory Traversal OpenPanel 0.3.4 - Incorrect Access Control OpenPanel 0.3.4 - OS Command Injection OpenPanel Copy and View functions in the File Manager 0.3.4 - Directory Traversal Pimcore 11.4.2 - Stored cross site scripting Pimcore customer-data-framework 4.2.0 - SQL injection SilverStripe 5.3.8 - Stored Cross Site Scripting (XSS) (Authenticated) Xinet Elegant 6 Asset Lib Web UI 6.1.655 - SQL Injection
30 lines
No EOL
1.2 KiB
Python
Executable file
30 lines
No EOL
1.2 KiB
Python
Executable file
# Exploit Title: Authenticated Stored Cross-Site Scripting (XSS) Via Search
|
|
Document
|
|
# Google Dork: N/A
|
|
# Date: 1/28/2025
|
|
# Exploit Author: maeitsec
|
|
# Vendor Homepage: https://pimcore.com/
|
|
# Software Link: https://github.com/pimcore/pimcore
|
|
# Version: Pimcore 10.5.x (prior to 10.5.21) and 11.x (prior to 11.1.1)
|
|
# Tested on: Pimcore 10.5.20 on Ubuntu 20.04
|
|
# CVE: CVE-2024-11954
|
|
|
|
---
|
|
|
|
### Description:
|
|
A stored Cross-Site Scripting (XSS) vulnerability exists in Pimcore's Data
|
|
Object Classification Store functionality. The vulnerability arises due to
|
|
insufficient input sanitization, allowing an authenticated attacker with
|
|
access to the classification store to inject malicious JavaScript code.
|
|
This code is then executed in the context of other users' browsers when
|
|
they view the affected data.
|
|
|
|
### Proof of Concept (PoC):
|
|
1. Log in to the Pimcore backend as a user with access to the Data Object
|
|
Classification Store.
|
|
2. Navigate to the Classification Store and create or edit a key.
|
|
3. Inject the following payload into the key value:
|
|
```html
|
|
<script>alert('XSS')</script>
|
|
4. Save the file and view it in the frontend or backend. The JavaScript
|
|
alert will execute, demonstrating the vulnerability. |