CVE-2023-39007 PoC — Deciso OPNsense 跨站脚本漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39007.yaml

Associated Vulnerability

Title:Deciso OPNsense 跨站脚本漏洞 (CVE-2023-39007)
Description:Deciso OPNsense是荷兰Deciso公司的一套基于FreeBSD的开源防火墙和路由软件。 Deciso OPNsense 23.7之前版本存在跨站脚本漏洞，该漏洞源于组件/ui/cron/item/open存在跨站脚本（XSS）漏洞。

Description

There is a XSS in /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 via openAction in app/controllers/OPNsense/Cron/ItemController.php.

File Snapshot


 id: CVE-2023-39007

info:
  name: OPNsense - Cross-Site Scripting to RCE
  author: ritikchaddha
  se

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!