| 제목 | Authenticated Reflected XSS in koha unimarc 23.05.03 |
|---|
| 설명 | There is, a vulnerability of type XSS reflected in koha unimarc the latest version released on August 30, to reproduce the vulnerability what there is is to login, then go to advanced search and with this write our exploit, here below I show the PoC
This is the url of advanced search
To see the PoC video you just have to go to this link The video is private, only the link can be accessed
http://localhost:8001/cgi-bin/koha/catalogue/search.pl?q=
PoC of the vuln:
https://drive.google.com/file/d/1Rd-Mz4r4CSX_CAdWWTS-5hpnwzi07FVr/view?usp=sharing
https://drive.google.com/file/d/1S7MTpeGyJPHGIjTrl0SYf_T2S15TxJZH/view?usp=sharing
https://drive.google.com/file/d/1i_KdeWEfe-5HAZoXmRheEdul3HGF3nPb/view?usp=sharing
https://drive.google.com/file/d/1Ae1uj3AI10acUnfNF8pm2RtmBnIoIhVr/view?usp=sharing
https://www.youtube.com/watch?v=b5107YkpgaM
Report another vulnerability of another sofftware that koha has that is vulnerable to xss reflected also, the PoC is similar but they are different models, so they are two different cve
Here is the guide that I use to install the software: https://www.vijenderkumar.com/2023/01/easy-steps-to-install-koha-on.html
If you need more information, please let me know
I also just reported another vulnerability in other software that they have, it is similar to the PoC |
|---|
| 원천 | ⚠️ https://www.youtube.com/watch?v=b5107YkpgaM |
|---|
| 사용자 | ph03n1xsp (UID 53845) |
|---|
| 제출 | 2023. 09. 12. AM 11:39 (3 연령 ago) |
|---|
| 모더레이션 | 2023. 09. 16. AM 10:21 (4 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 239866 [KOHA 까지 23.05.03 MARC search.pl 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|