Advertisement
CVE | Category | Price | Severity |
---|---|---|---|
CWE-79 | $500 | High |
Author | Risk | Exploitation Type | Date |
---|---|---|---|
Not specified | High | Remote | 2018-07-09 |
CVSS | EPSS | EPSSP |
---|---|---|
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | 0.02192 | 0.50148 |
###################### # Author Information # ###################### Author : Ahmed Elhady Mohamed twitter : @Ahmed__ELhady Date : 01/07/2018 ######################## # Software Information # ######################## Affected Software : SeoChecker Umbraco CMS Plug-in Version: version 1.9.2 Software website : https://soetemansoftware.nl/seo-checker ############### # Description # ############### SeoChecker Umbraco CMS Plug-in version 1.9.2 is vulnerable to stored cross-site scripting vulnerability in two parameters which are SEO title and SEO description HTML parameters fields. A low privilege authenticated user who can edit the SEO tab parameter value for any Ubmraco CMS content like an article will be able to inject a malicious code to execute arbitrary HTML and JS code in a user's browser session in the context of an affected site. so when a high privilege user tries to access/edit the article content. the JS code will be executed. The vulnerabilities are tested on 1.9.2 version and Other versions may also be affected. ################# # Exlpoit Steps # ################# 1- Access the application with a low privilege authenticated user 2- Go to the SEO tab for any article 3-Enter the following payload in SEO title and SEO description HTML parameters fields parameters "><script>alert(123)</script> 4- Access the article content page to edit and change contents value. 5- The JS code will be executed.
Copyright ©2024 Exploitalert.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.