CVE-2020-20285 PoC — ZZCMS 跨站脚本漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-20285.yaml

Associated Vulnerability

Title:ZZCMS 跨站脚本漏洞 (CVE-2020-20285)
Description:ZZCMS是中国Zzcms团队的一套内容管理系统（CMS）。 zzcms 2019 存在跨站脚本漏洞，该漏洞源于用户登录页面有XSS。用户可以通过用户login.php通过referer头注入js代码。

Description

ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks.

File Snapshot


 id: CVE-2020-20285

info:
  name: ZZcms - Cross-Site Scripting
  author: edoardottt
  severity: medi

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!