CVE-2023-33408 PoC — miniCal 跨站脚本漏洞

Source

https://github.com/Thirukrishnan/CVE-2023-33408

Associated Vulnerability

Title:miniCal 跨站脚本漏洞 (CVE-2023-33408)
Description:miniCal是miniCal开源的一款开源的 PMS。 miniCal 1.0.0版本存在安全漏洞，该漏洞源于输入验证不足，容易受到跨站脚本(XSS)攻击。

Readme

# CVE-2023-33408

Minical 1.0.0 is vulnerable to Stored Cross-Site Scripting (XSS)

Vendor: https://github.com/minical/minical  
Demo Application: https://demo.minical.io/

---

## PoC

Step 1: Log in to the Minical Application and Navigate to Room->Room Status.

![image](https://github.com/Thirukrishnan/CVE-2023-33408/assets/63901950/ee05ae12-4c67-441c-be40-58ffc5eb1617)


Step 2: Click on the **Edit Room Note** option and enter the payload.  
` Payload= <svg onload=alert(document.location)<!-- `

![image](https://github.com/Thirukrishnan/CVE-2023-33408/assets/63901950/a648fb1c-7e29-4fab-ab97-f23ac81bb263)

Step 3: Click on **Save Changes** and observe the payload getting triggered.

![image](https://github.com/Thirukrishnan/CVE-2023-33408/assets/63901950/fbeeec89-86ca-47ca-bc85-8c345cd3a5dc)

![image](https://github.com/Thirukrishnan/CVE-2023-33408/assets/63901950/623293f4-848b-44fb-b2b8-4afa3e0b8ca9)

File Snapshot


 [4.0K]  /data/pocs/4e0660968693995842a219f94e83561dca86cf28
└── [ 917]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!