b2evolution CMS 6.11.6 Cross Site Scripting

2021.02.11
Credit: Nakul Ratti
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

# Exploit Title: *Reflected XSS in b2evolution CMS 6.11.6 via tab3 parameter in evoadm.php* # CVE : *CVE-2020-22839* # Date: 10/02/2021 # Exploit Author: Nakul Ratti, Soham Bakore # Vendor Homepage: https://b2evolution.net/ # Software Link: https://b2evolution.net/downloads/6-11-6-stable?download=12405 # Version: 6.11.6 # Tested on: latest version of Chrome, Firefox on Windows and Linux Vulnerable File: -------------------------- http://host/evoadm.php Vulnerable Issue: -------------------------- Tab3 parameter has no input validation. --------------------------Proof of Concept----------------------- Steps to Reproduce: 1. Send the following URL *http://HOST/evoadm.php <http://host/evoadm.php>?* *.ctrl=comments&filter=restore&tab3=123%22onmouseover=%22alert(document.domain)%22&blog=1&blog=1* to the logged in victim using any social engineering technique. 2. When an unsuspecting user with high privileges opens this URL, XSS will be triggered which will execute the malicious javascript payload in users browser. 3. The vulnerable parameter in this case is “*tab3*”.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top