CVE-2023-33408 PoC — miniCal 跨站脚本漏洞

介绍

# CVE-2023-33408

Minical 1.0.0 is vulnerable to Stored Cross-Site Scripting (XSS)

Vendor: https://github.com/minical/minical  
Demo Application: https://demo.minical.io/

---

## PoC

Step 1: Log in to the Minical Application and Navigate to Room->Room Status.

![image](https://github.com/Thirukrishnan/CVE-2023-33408/assets/63901950/ee05ae12-4c67-441c-be40-58ffc5eb1617)


Step 2: Click on the **Edit Room Note** option and enter the payload.  
` Payload= <svg onload=alert(document.location)<!-- `

![image](https://github.com/Thirukrishnan/CVE-2023-33408/assets/63901950/a648fb1c-7e29-4fab-ab97-f23ac81bb263)

Step 3: Click on **Save Changes** and observe the payload getting triggered.

![image](https://github.com/Thirukrishnan/CVE-2023-33408/assets/63901950/fbeeec89-86ca-47ca-bc85-8c345cd3a5dc)

![image](https://github.com/Thirukrishnan/CVE-2023-33408/assets/63901950/623293f4-848b-44fb-b2b8-4afa3e0b8ca9)

文件快照

备注