CVE-2022-43332 PoC — WonderCMS 跨站脚本漏洞

Source

https://github.com/maikroservice/CVE-2022-43332

Associated Vulnerability

Title: WonderCMS 跨站脚本漏洞 (CVE-2022-43332)
Description:A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel.

Description

Cross Site Scripting in WonderCMS v3.3.4

Readme

# CVE-2022-43332
Cross Site Scripting in WonderCMS

Description:
A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows potential attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel - coupled with the fact that the cookie has no HttpOnly Flag this could be used to steal cookies of logged-in users. 

How to Reproduce:
To reproduce one can download the zip file provided at wondercms.com (3.3.4), unzip it to a web server and after login with the password provided on the homepage in the settings menu the title can be adjusted - the vulnerability can be triggered with the following payload: <script>javascript:alert(document.cookie)</script>

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →