| 标题 | Siberian Siberian CMS 4.20.6 Reflected Cross-Site Scripting |
|---|
| 描述 | Cross-Site Scripting (XSS) is one of the most common vulnerabilities in web applications. It occurs when the application does not properly validate or sanitize user input, allowing malicious scripts to be injected and executed in the context of another user's browser.
In the case of Siberian CMS, it was found that certain URLs or parameters receive content without proper sanitization, allowing an attacker to create a modified link and trick legitimate users into clicking on it. In this way, the attacker can execute arbitrary code in the victims' browser.
The proof of concept (PoC) confirming the existence of XSS was demonstrated using the following URL (simplified example):
https://x.x.x.x/app/sae/design/desktop/flat"><img src=x onerror=alert(document.location)>/js/bootstrap-tagsinput.min.js
https://app.viaetica.com/app/sae/design/desktop/flat%22%3E%3Cimg%20src=x%20onerror=alert(document.location)%3E/js/bootstrap-tagsinput.min.js
Note that the final parameter inserts an img element with an onerror attribute that triggers the alert(document.location) method. The relevant part is:
"><img src=x onerror=alert(document.location)>
This HTML + JavaScript injection occurs due to the point where the application does not properly sanitize the parameters, allowing the inclusion of an img and then the onerror event with alert().
Google Dork:
intitle:"Login to your admin interface"
Vendor:
https://www.siberiancms.com/ |
|---|
| 用户 | Eduardo Maragno (UID 80876) |
|---|
| 提交 | 2025-01-28 21時54分 (2 年前) |
|---|
| 管理 | 2025-02-07 10時42分 (10 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 294938 [SiberianCMS 4.20.6 HTTP GET Request flat 跨网站脚本] |
|---|
| 积分 | 17 |
|---|