CVE-2023-39002 PoC — Deciso OPNsense 跨站脚本漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-39002.yaml

Associated Vulnerability

Title:Deciso OPNsense 跨站脚本漏洞 (CVE-2023-39002)
Description:Deciso OPNsense是荷兰Deciso公司的一套基于FreeBSD的开源防火墙和路由软件。 OPNsense 23.7之前版本存在跨站脚本漏洞，该漏洞源于system_certmanager.php文件的act参数存在跨站脚本（XSS）漏洞。攻击者可利用该漏洞通过设计有效负载执行任意Web脚本或HTML代码。

Description

A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense before 23.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

File Snapshot


 id: CVE-2023-39002

info:
  name: OPNsense - Cross-Site Scripting
  author: Herry
  severity: medium

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!