CVE-2023-33408 PoC — miniCal 跨站脚本漏洞

Source

https://github.com/Thirukrishnan/CVE-2023-33408

Associated Vulnerability

Title: miniCal 跨站脚本漏洞 (CVE-2023-33408)
Description:Minical 1.0.0 is vulnerable to Cross Site Scripting (XSS). The vulnerability exists due to insufficient input validation in the application's user input handling in the security_helper.php file.

Readme

# CVE-2023-33408

Minical 1.0.0 is vulnerable to Stored Cross-Site Scripting (XSS)

Vendor: https://github.com/minical/minical  
Demo Application: https://demo.minical.io/

---

## PoC

Step 1: Log in to the Minical Application and Navigate to Room->Room Status.

![image](https://github.com/Thirukrishnan/CVE-2023-33408/assets/63901950/ee05ae12-4c67-441c-be40-58ffc5eb1617)


Step 2: Click on the **Edit Room Note** option and enter the payload.  
` Payload= <svg onload=alert(document.location)<!-- `

![image](https://github.com/Thirukrishnan/CVE-2023-33408/assets/63901950/a648fb1c-7e29-4fab-ab97-f23ac81bb263)

Step 3: Click on **Save Changes** and observe the payload getting triggered.

![image](https://github.com/Thirukrishnan/CVE-2023-33408/assets/63901950/fbeeec89-86ca-47ca-bc85-8c345cd3a5dc)

![image](https://github.com/Thirukrishnan/CVE-2023-33408/assets/63901950/623293f4-848b-44fb-b2b8-4afa3e0b8ca9)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →