发布 2023-04-05 漏洞条目

BTCPay Server v1.7.4 – HTML Injection

Exploit Source

# Exploit Title: BTCPay Server v1.7.4 - HTML Injection

# Date: 01/26/2023

# Exploit Author: Manojkumar J (TheWhiteEvil)

# Vendor Homepage: https://github.com/btcpayserver/btcpayserver

# Software Link:

https://github.com/btcpayserver/btcpayserver/releases/tag/v1.7.5

# Version: <=1.7.4

# Tested on: Windows10

# CVE : CVE-2023-0493

# Description:

BTCPay Server v1.7.4 HTML injection vulnerability.

# Steps to exploit:

1. Create an account on the target website.

2. Move on to the API key and create API key with the html injection in the

label field.

Example:

<a href="https://hackerbro.in">clickhere</a>

3. Click remove/delete API key, the html injection will render.

相关漏洞条目