CVE-2014-100004 PoC — Sitecore CMS 跨站脚本漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-100004.yaml

Associated Vulnerability

Title:Sitecore CMS 跨站脚本漏洞 (CVE-2014-100004)
Description:Sitecore CMS是丹麦Sitecore公司的一套在线营销内容管理系统（CMS）。该系统支持内容编辑、多种语言、多网站部署、数字资产管理等。 Sitecore CMS 7.0 3及之前版本中存在跨站脚本漏洞，该漏洞源于默认的URI没有充分过滤‘xmlcontrol’参数。远程攻击者可利用该漏洞注入任意Web脚本或HTML。

Description

Sitecore CMS contains a cross-site scripting vulnerability via the "special way" of displaying XML Controls directly, which allows for a Cross Site Scripting Attack.

File Snapshot


 id: CVE-2014-100004

info:
  name: Sitecore CMS - Cross-Site Scripting
  author: DhiyaneshDK
  sever

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!