ERPnext 11 Cross-Site Scripting

2018-05-23 / 2018-05-30
Risk: Low
Local: No
Remote: Yes
CWE: N/A

# Exploit Title: ERPnext 11.x.x - Cross-Site Scripting # Date: 2018-05-10 # Exploit Author: Veerababu Penugonda # Vendor Homepage: https://erpnext.com/ # Software Link: https://demo.erpnext.com/ # Version: Frappe ERPNext v11.x.x-develop # Tested on: Mozilla Firefox quantum 60.1 , Ubuntu OS # CVE : CVE-2018-11339 # 1. Description: # https://demo.erpnext.com/desk#Form/Asset%20Repair/ARLOG-000015 # and functionality “Comment” is vulnerable to XSS like Stored , # Reflected , Cookie , possible for more # 2. Payload : "><script>alert(1)</script>


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top