CVE-2022-29349 PoC — Keking kkFileView 跨站脚本漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29349.yaml

Associated Vulnerability

Title:Keking kkFileView 跨站脚本漏洞 (CVE-2022-29349)
Description:Keking KkFileview是中国凯京科技（Keking）公司的一个 Spring-Boot 打造文件文档在线预览项目。 kkFileView 4.0.0版本存在安全漏洞，该漏洞源于。通过 /controller/OnlinePreviewController.java 中的 url 参数发现存在跨站点脚本 (XSS) 漏洞。

Description

kkFileView 4.0.0 contains multiple cross-site scripting vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java.

File Snapshot


 id: CVE-2022-29349

info:
  name: kkFileView 4.0.0 - Cross-Site Scripting
  author: arafatansari
  s

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!