CVE-2021-40969 PoC — spotweb 跨站脚本漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40969.yaml

Associated Vulnerability

Title:spotweb 跨站脚本漏洞 (CVE-2021-40969)
Description:Spotweb是Spotweb团队的一款基于Php的遵循Spotnet协议的Soptnet客户端。 spotweb 1.5.1 及以下版本中存在跨站脚本漏洞，该漏洞允许远程攻击者通过 firstname 参数注入任意 Web 脚本或 HTML。

Description

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the firstname parameter.

File Snapshot


 id: CVE-2021-40969

info:
  name: Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)
  author: thea

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!