CVE-2022-47373 PoC — Pandora FMS Console 跨站脚本漏洞

Description

Reflected Cross Site Scripting Vulnerability in PandoraFMS <= v766

介绍

# CVE-2022-47373
Reflected Cross Site Scripting Vulnerability in PandoraFMS <= v766


##### > Exploit Title: Reflected Cross Site Scripting
##### > Date: 15/02/2023
##### > Exploit Author: Gaurish Kauthankar
##### > Vendor Homepage: https://pandorafms.com/en/
##### > Software Link: https://github.com/pandorafms/pandorafms
##### > Version: <= v766
##### > Tested on: Ubuntu
##### > CVE : CVE-2022-47373


### Steps to reproduce:  
1. Add xss payload in the search functionality present in module library section.  
2. Observe payload execution.  
3. Now share the url containing xss payload with the victim user to steal cookies, redirecting to evil website, etc.

文件快照

备注