CVE-2018-1000671 PoC — Sympa 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000671.yaml

Associated Vulnerability

Title:Sympa 安全漏洞 (CVE-2018-1000671)
Description:Sympa是一套可拓展性强、高度自定义化的邮件列表软件。该软件提供多套模板、自定义身份鉴定后端和鉴定脚本，以及支持各种邮件列表后端（LDAP、SQL、文本、列表或者其它）。 Sympa 6.2.16及之后的版本中的wwsympa.fcgi登录操作的‘referer’参数存在开放重定向漏洞。攻击者可借助URLs利用该漏洞将用户重定向到其他网站。

Description

Sympa version 6.2.16 and later contains a URL Redirection to Untrusted Site vulnerability in the referer parameter of the wwsympa fcgi login action that can result in open redirection and reflected cross-site scripting via data URIs.

File Snapshot


 id: CVE-2018-1000671

info:
  name: Sympa version =>6.2.16 - Cross-Site Scripting
  author: 0x_Akoko

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!