| 제목 | Siberian Siberian CMS 4.20.6 Reflected Cross-Site Scripting |
|---|
| 설명 | Cross-Site Scripting (XSS) is one of the most common vulnerabilities in web applications. It occurs when the application does not properly validate or sanitize user input, allowing malicious scripts to be injected and executed in the context of another user's browser.
In the case of Siberian CMS, it was found that certain URLs or parameters receive content without proper sanitization, allowing an attacker to create a modified link and trick legitimate users into clicking on it. In this way, the attacker can execute arbitrary code in the victims' browser.
The proof of concept (PoC) confirming the existence of XSS was demonstrated using the following URL (simplified example):
https://x.x.x.x/app/sae/design/desktop/flat"><img src=x onerror=alert(document.location)>/js/bootstrap-tagsinput.min.js
https://app.viaetica.com/app/sae/design/desktop/flat%22%3E%3Cimg%20src=x%20onerror=alert(document.location)%3E/js/bootstrap-tagsinput.min.js
Note that the final parameter inserts an img element with an onerror attribute that triggers the alert(document.location) method. The relevant part is:
"><img src=x onerror=alert(document.location)>
This HTML + JavaScript injection occurs due to the point where the application does not properly sanitize the parameters, allowing the inclusion of an img and then the onerror event with alert().
Google Dork:
intitle:"Login to your admin interface"
Vendor:
https://www.siberiancms.com/ |
|---|
| 사용자 | Eduardo Maragno (UID 80876) |
|---|
| 제출 | 2025. 01. 28. PM 09:54 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 02. 07. AM 10:42 (10 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 294938 [SiberianCMS 4.20.6 HTTP GET Request flat 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 17 |
|---|