CVE-2022-43332 PoC — WonderCMS 跨站脚本漏洞

Source

https://github.com/maikroservice/CVE-2022-43332

Associated Vulnerability

Title:WonderCMS 跨站脚本漏洞 (CVE-2022-43332)
Description:WonderCMS是一套基于PHP的开源内容管理系统（CMS）。 WonderCMS v3.3.4版本存在安全漏洞。攻击者利用该漏洞执行任意web脚本或HTML。

Description

Cross Site Scripting in WonderCMS v3.3.4

Readme

# CVE-2022-43332
Cross Site Scripting in WonderCMS

Description:
A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows potential attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel - coupled with the fact that the cookie has no HttpOnly Flag this could be used to steal cookies of logged-in users. 

How to Reproduce:
To reproduce one can download the zip file provided at wondercms.com (3.3.4), unzip it to a web server and after login with the password provided on the homepage in the settings menu the title can be adjusted - the vulnerability can be triggered with the following payload: <script>javascript:alert(document.cookie)</script>

File Snapshot


 [4.0K]  /data/pocs/b1de5f32fb299bae8652c3b7fbdd3eff28acc743
└── [ 742]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!