发布 2018-07-23 漏洞条目

Kirby CMS 2.5.12 – Cross-Site Scripting

Exploit Source

# Exploit Title: Kirby CMS 2.5.12 - Cross-Site Scripting

# Date: 2018-07-22

# Exploit Author: Zaran Shaikh

# Version: 2.5.12

# CVE : NA

# Category: Web Application

# Description

# The application allows user injected payload which can lead to Stored

# Cross Site Scripting.

# Proof of Concept

# 1. Visit the application as low priv user

# 2. Go to add page option

# 3. Under title, enter any XSS payload like:

# 4. Upon the payload being injected, the subsequent page is triggered

# with XSS

相关漏洞条目