CVE-2022-24086 PoC — Adobe Magento 输入验证错误漏洞

Description

An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

介绍

# CVE-2022-24682 PoC

 ## How does this detection method work?

As stated on the advisories versions 8.8.x before 8.8.15 patch 30 (update 1) are vulnerable to attacks, the template looks at the following versions:

```
          - "8.8"
          - "8.8.6"
          - "8.8.7"
          - "8.8.8"
          - "8.8.9"
          - "8.8.10"
          - "8.8.11"
          - "8.8.12"
          - "8.8.15"
```

 ## How do I run this script?

1. Download Nuclei from [here](https://github.com/projectdiscovery/nuclei)
2. Copy the template to your local system
3. Run the following command: `nuclei -u https://yourHost.com -t template.yaml` 

## References

- https://nvd.nist.gov/vuln/detail/CVE-2022-24682
- https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/


## Disclaimer

Use at your own risk, I will not be responsible for illegal activities you conduct on infrastructure you do not own or have permission to scan.

文件快照

备注