CVE-2020-13483 PoC — Bitrix24 Web Application Firewall 跨站脚本漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13483.yaml

Associated Vulnerability

Title:Bitrix24 Web Application Firewall 跨站脚本漏洞 (CVE-2020-13483)
Description:Bitrix24是美国Bitrix公司的一套企业社交平台。该平台包括在线通讯、日历管理和CRM（客户关系管理）等功能。Web Application Firewall是其中的一个Web应用程序防火墙。 Bitrix24 20.0.0及之前版本中的Web Application Firewall存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。

Description

The Web Application Firewall in Bitrix24 up to and including 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.list/ajax.php/ URI.

File Snapshot


 id: CVE-2020-13483

info:
  name: Bitrix24 <=20.0.0 - Cross-Site Scripting
  author: pikpikcu,3th1c_

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!