BloofoxCMS 0.5.2.1 – ‘text’ Stored Cross Site Scripting

Exploit Database
113 阅读

作者： LiPeiYi

日期： 2021-01-29
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/49492/

# Title: BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting

# Exploit Author: LiPeiYi

# Date: 2020-12-18

# Vendor Homepage: https://www.bloofox.com/

# Software Link: https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1

# Version: 0.5.1.0 -.5.2.1

# Tested on: windows 10

Vulnerable paper: /admin/include/inc_content_articles.php

Steps to reproduce:

1: Log in with a valid username and password. Navigate to the "articles" tab on the left-hand side.

2: Add the new post and then add the payload "payload: <img src=# onerror=alert('xss')>" in "text" parameter and click on save button. Post Saved successfully.

3: Now, XSS will get stored and trigger every time and the attacker can steal authenticated users' cookies.

last Exploits
BloofoxCMS 0.5.2.1 – ‘text’ Stored Cross Site Scripting的更多信息

PHPKB Knowledge Base Software 2.0 – Multilanguage Support Multiple SQL Injections：
PolarisCMS – ‘WebForm_OnSubmit()’ Cross-Site Scripting：
Bs General_Classifieds Script – SQL Injection：
Student Quarterly Grading System 1.0 – ‘grade’ Stored Cross-Site Scripting (XSS)：
web@all – Local File Inclusion / Multiple Arbitrary File Upload Vulnerabilities：
Apple iOS 7.0.2 – Sim Lock Screen Display Bypass：
IP.Gallery 4.2.x/5.0.x – Persistent Cross-Site Scripting：
4Images 1.7.9 – Multiple Vulnerabilities：