CVE-2023-35158 PoC — XWiki Platform 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35158.yaml

Associated Vulnerability

Title:XWiki Platform 安全漏洞 (CVE-2023-35158)
Description:XWiki Platform是法国XWiki基金会的一套用于创建Web协作应用程序的Wiki平台。 XWiki Platform 9.4-rc-1之前版本存在安全漏洞。攻击者利用该漏洞伪造URL在页面中注入Javascript代码，并通过restore template来执行跨站脚本（XSS）攻击。

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as: > /xwiki/bin/view/XWiki/Main?xpage=restore&showBatch=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 9.4-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.

File Snapshot


 id: CVE-2023-35158

info:
  name: XWiki - Cross-Site Scripting
  author: ritikchaddha
  severity: me

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!