Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2024-22411 PoC — Avo 跨站脚本漏洞

Source
Associated Vulnerability
Title:Avo 跨站脚本漏洞 (CVE-2024-22411)
Description:Avo是Avo开源的一个开源的 ruby on rails 管理面板创建框架。 Avo 3 pre12版本存在跨站脚本漏洞,该漏洞源于Avo::BaseAction子类存在跨站脚本(XSS)漏洞。
Readme
# README

This README would normally document whatever steps are necessary to get the
application up and running.

Things you may want to cover:

* Ruby version

* System dependencies

* Configuration

* Database creation

* Database initialization

* How to run the test suite

* Services (job queues, cache servers, search engines, etc.)

* Deployment instructions

* ...
File Snapshot

[4.0K] /data/pocs/22cf6c9fe3207c687988afcbca09fdd3f7a6469a ├── [4.0K] app │   ├── [4.0K] assets │   │   ├── [4.0K] config │   │   │   └── [ 143] manifest.js │   │   ├── [4.0K] images │   │   └── [4.0K] stylesheets │   │   └── [ 721] application.css │   ├── [4.0K] avo │   │   ├── [4.0K] actions │   │   │   └── [ 272] toggle_inactive.rb │   │   └── [4.0K] resources │   │   └── [ 334] user.rb │   ├── [4.0K] channels │   │   └── [4.0K] application_cable │   │   ├── [ 79] channel.rb │   │   └── [ 85] connection.rb │   ├── [4.0K] controllers │   │   ├── [ 57] application_controller.rb │   │   ├── [4.0K] avo │   │   │   └── [ 194] users_controller.rb │   │   ├── [4.0K] concerns │   │   └── [1.8K] users_controller.rb │   ├── [4.0K] helpers │   │   ├── [ 29] application_helper.rb │   │   └── [ 23] users_helper.rb │   ├── [4.0K] javascript │   │   ├── [ 157] application.js │   │   └── [4.0K] controllers │   │   ├── [ 218] application.js │   │   ├── [ 157] hello_controller.js │   │   └── [ 584] index.js │   ├── [4.0K] jobs │   │   └── [ 269] application_job.rb │   ├── [4.0K] mailers │   │   └── [ 102] application_mailer.rb │   ├── [4.0K] models │   │   ├── [ 74] application_record.rb │   │   ├── [4.0K] concerns │   │   └── [ 35] user.rb │   └── [4.0K] views │   ├── [4.0K] layouts │   │   ├── [ 357] application.html.erb │   │   ├── [ 227] mailer.html.erb │   │   └── [ 13] mailer.text.erb │   └── [4.0K] users │   ├── [ 165] edit.html.erb │   ├── [ 609] _form.html.erb │   ├── [ 251] index.html.erb │   ├── [ 53] index.json.jbuilder │   ├── [ 118] new.html.erb │   ├── [ 245] show.html.erb │   ├── [ 40] show.json.jbuilder │   ├── [ 163] _user.html.erb │   └── [ 104] _user.json.jbuilder ├── [4.0K] bin │   ├── [2.7K] bundle │   ├── [ 191] docker-entrypoint │   ├── [ 91] importmap │   ├── [ 141] rails │   ├── [ 90] rake │   └── [ 984] setup ├── [4.0K] config │   ├── [ 999] application.rb │   ├── [ 207] boot.rb │   ├── [ 231] cable.yml │   ├── [ 456] credentials.yml.enc │   ├── [ 635] database.yml │   ├── [ 128] environment.rb │   ├── [4.0K] environments │   │   ├── [2.6K] development.rb │   │   ├── [4.2K] production.rb │   │   └── [2.6K] test.rb │   ├── [ 300] importmap.rb │   ├── [4.0K] initializers │   │   ├── [ 502] assets.rb │   │   ├── [3.2K] avo.rb │   │   ├── [1.0K] content_security_policy.rb │   │   ├── [ 448] filter_parameter_logging.rb │   │   ├── [ 649] inflections.rb │   │   └── [ 480] permissions_policy.rb │   ├── [4.0K] locales │   │   ├── [5.0K] avo.ar.yml │   │   ├── [4.0K] avo.en.yml │   │   ├── [4.4K] avo.fr.yml │   │   ├── [3.9K] avo.nb.yml │   │   ├── [3.8K] avo.nn.yml │   │   ├── [4.2K] avo.pt-BR.yml │   │   ├── [4.2K] avo.pt.yml │   │   ├── [4.3K] avo.ro.yml │   │   ├── [4.3K] avo.tr.yml │   │   ├── [ 908] en.yml │   │   └── [4.0K] pagy │   │   ├── [ 519] nn.yml │   │   └── [ 613] ro.yml │   ├── [1.6K] puma.rb │   ├── [ 512] routes.rb │   └── [1.1K] storage.yml ├── [ 160] config.ru ├── [4.0K] db │   ├── [4.0K] migrate │   │   └── [ 174] 20240119090711_create_users.rb │   ├── [ 955] schema.rb │   └── [ 494] seeds.rb ├── [1.8K] Dockerfile ├── [2.2K] Gemfile ├── [7.3K] Gemfile.lock ├── [4.0K] lib │   ├── [4.0K] assets │   └── [4.0K] tasks ├── [4.0K] log ├── [4.0K] public │   ├── [1.7K] 404.html │   ├── [1.7K] 422.html │   ├── [1.6K] 500.html │   ├── [ 0] apple-touch-icon.png │   ├── [ 0] apple-touch-icon-precomposed.png │   ├── [ 0] favicon.ico │   └── [ 99] robots.txt ├── [ 227] Rakefile ├── [ 374] README.md ├── [4.0K] storage ├── [4.0K] test │   ├── [ 157] application_system_test_case.rb │   ├── [4.0K] channels │   │   └── [4.0K] application_cable │   │   └── [ 276] connection_test.rb │   ├── [4.0K] controllers │   │   └── [1009] users_controller_test.rb │   ├── [4.0K] fixtures │   │   ├── [4.0K] files │   │   └── [ 172] users.yml │   ├── [4.0K] helpers │   ├── [4.0K] integration │   ├── [4.0K] mailers │   ├── [4.0K] models │   │   └── [ 118] user_test.rb │   ├── [4.0K] system │   │   └── [ 928] users_test.rb │   └── [ 410] test_helper.rb └── [4.0K] vendor └── [4.0K] javascript 50 directories, 91 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.