CVE-2024-7008 PoC — Calibre 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7008.yaml

Associated Vulnerability

Title:Calibre 安全漏洞 (CVE-2024-7008)
Description:Calibre是印度Kovid Goyal个人开发者的一个开源免费的全能电子书阅读管理与格式转换工具。 Calibre 7.15.0版本及之前版本存在安全漏洞，该漏洞源于用户输入清理不当，允许攻击者执行反射型跨站脚本攻击。

Description

It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with authentication enabled and the victim is logged in at the time, this can be used to cause the victim to perform actions on the Calibre server on behalf of the attacker.

File Snapshot


 id: CVE-2024-7008

info:
  name: Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS)
  author: 

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!