CVE-2020-25399 PoC — Mind iMind Server 跨站脚本漏洞

Source

https://github.com/h3llraiser/CVE-2020-25399

Associated Vulnerability

Title:Mind iMind Server 跨站脚本漏洞 (CVE-2020-25399)
Description:Mind iMind Server是俄罗斯mind的一个视频会议平台。 Mind iMind Server 3.13.65及之前版本存在跨站脚本漏洞，该漏洞允许任何用户通过在聊天中发送恶意文件来劫持另一个用户的会话。

Description

Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat.

Readme

# CVE-2020-25399
Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat.
# Information

Description: Attacker can send malicious file to any user using chat functional. File may contain js payload, which executes in victim's browser after file opens.

Researcher: Andrey Skuratov (https://github.com/h3llraiser/)

Issue date: 2020-07-06 (Initial Advisory)

Public release:

VEL Link: Info will be soon

NIST CVE Link: Info will be soon


# Screenshots:

![](POC_1_1.png)
![](POC_1_2.png)

File Snapshot


 [4.0K]  /data/pocs/89e397c8d16b34eae26b6e4a0e28be5b79b4acf0
├── [7.9K]  POC_1_1.png
├── [ 23K]  POC_1_2.png
└── [ 576]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!