目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CVE-2025-50481 PoC — mezzanine 安全漏洞

来源
https://github.com/kevinpdicks/Mezzanine-CMS-6.1.0-XSS
关联漏洞
标题:mezzanine 安全漏洞 (CVE-2025-50481)
Description:mezzanine是stephenmcd个人开发者的一个Django的CMS框架。 mezzanine v6.1.0版本存在安全漏洞，该漏洞源于/blog/blogpost/add组件输入验证不足，可能导致跨站脚本攻击。
Description
Mezzanine CMS 6.1.0 XSS (CVE-2025-50481)
介绍
# Mezzanine-CMS-6.1.0-XSS (CVE-2025-50481)
###### Description
A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a blog post.
###### CVE:
CVE-2025-50481
###### Affected version:
Mezzanine CMS 6.1.0
###### Base Score: 
4.8 Medium
###### Vector: 
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
###### References
- https://github.com/stephenmcd/mezzanine
- https://github.com/kevinpdicks/Mezzanine-CMS-6.1.0-XSS
##### Summary
Mezzanine CMS 6.1.0 version is affected by a stored cross-site scripting (XSS) vulnerability.

A XSS vulnerability exists in the new blog post functionality on the CMS, where an malicious authenticated attacker can craft a carefully formatted blog post containing JavaScript code, which is executed by the browser.

An attacker can leverage the XSS vulnerability to carry out attacks against the CMS website, such as defacement, or tamper with the site and cause it to be unavailable (denial-of-service).
##### Technical Description
Mezzanine CMS 6.1.0 running on Ubuntu Server 20.04.6 LTS (Focal Fossa) from pip package:
![image](https://github.com/user-attachments/assets/8aea3d50-06b2-4ff6-a5c7-32aa044a41d5)

First an authenticated attacker creates a new blog post:
![image](https://github.com/user-attachments/assets/285ac6c1-d05a-4ef4-abe8-349f12bfc17b)

Assign blog post a title:
![image](https://github.com/user-attachments/assets/6a799420-c779-42a3-9e34-f1ecccdf537d)

Create the XSS proof-of-concept (PoC) within the source code formatting of the blog post:
![image](https://github.com/user-attachments/assets/c7464fbf-b7a6-4a56-8639-92cb9fcaa828)

Save the new blog post:
![image](https://github.com/user-attachments/assets/da7301f4-4161-4289-a5e7-232b893521af)

The blog post can be published and then accessed by any user:
![image](https://github.com/user-attachments/assets/8eb05c6f-8132-4cad-9b94-ca02293abe03)

Accessing the blog post with the XSS PoC triggers the JavaScript code in the browser:
![image](https://github.com/user-attachments/assets/d8b4f919-4526-48fb-940d-ad57180fe78a)

PoC was tested using Firefox browser version 136.0 (64-bit):
![image](https://github.com/user-attachments/assets/e757d0ee-8338-46f8-adc7-6dda256278bd)

Note: Session hijacking with the XSS vulnerability is not possible, as the sessionid session cookie is not accessible, since it is configured with the HttpOnly security attribute:
![image](https://github.com/user-attachments/assets/f5dd9e61-5a21-4827-8c85-ab02addb5c52)
文件快照

 [4.0K]  /data/pocs/0a90d184b5281b03578729fb957b8ce24b88f393
├── [ 34K]  LICENSE
└── [2.5K]  README.md

0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。