9d8170fd85
9 changes to exploits/shellcodes TP-Link Wireless N Router WR840N - Denial of Service (PoC) Splinterware System Scheduler Pro 5.12 - Privilege Escalation iSmartViewPro 1.5 - 'Device Alias' Buffer Overflow iSmartViewPro 1.5 - 'Account' Buffer Overflow OpenEMR < 5.0.1 - Remote Code Execution Kirby CMS 2.5.12 - Cross-Site Scripting osTicket 1.10.1 - Arbitrary File Upload LG-Ericsson iPECS NMS 30M - Directory Traversal LAMS < 3.1 - Cross-Site Scripting onArcade 2.4.2 - Cross-Site Request Forgery (Add Admin) Monstra 3.0.4 - Cross-Site Scripting LAMS < 3.1 - Cross-Site Scripting onArcade 2.4.2 - Cross-Site Request Forgery (Add Admin) Monstra 3.0.4 - Cross-Site Scripting
20 lines
No EOL
561 B
Text
20 lines
No EOL
561 B
Text
# Exploit Title: Kirby CMS 2.5.12 - Cross-Site Scripting
|
||
# Date: 2018-07-22
|
||
# Exploit Author: Zaran Shaikh
|
||
# Version: 2.5.12
|
||
# CVE : NA
|
||
# Category: Web Application
|
||
|
||
# Description
|
||
# The application allows user injected payload which can lead to Stored
|
||
# Cross Site Scripting.
|
||
|
||
# Proof of Concept
|
||
# 1. Visit the application as low priv user
|
||
# 2. Go to add page option
|
||
# 3. Under title, enter any XSS payload like:
|
||
|
||
<script>alert("XSS");</script>
|
||
|
||
# 4. Upon the payload being injected, the subsequent page is triggered
|
||
# with XSS |