Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2024-25411 PoC — FlatPress 安全漏洞

Source
Associated Vulnerability
Title:FlatPress 安全漏洞 (CVE-2024-25411)
Description:FlatPress是FlatPress社区的一个基于Php无需数据库支持的博客建站系统。 FlatPress v1.3版本存在安全漏洞,该漏洞源于存在跨站脚本(XSS)漏洞,允许攻击者通过向setup.php中的username参数注入精心设计的有效载荷来执行任意Web脚本或HTML。
Description
A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter in setup.php
Readme
# CVE-2024-25411
A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter in setup.php

 Vulnerability Type : Cross Site Scripting (XSS)

Vendor of Product : https://github.com/flatpressblog/flatpress

Affected Product Code Base: Affected version : FlatPress 1.2.1 Latest - will be fixed in FlatPress version 1.3.

Affected Component:
Cross-Site Scripting (XSS) in FlatPress Installer In username parameter

Attack Type: Remote

Reference:

https://portswigger.net/web-security/cross-site-scripting

https://github.com/flatpressblog/flatpress/pull/261

Discoverer:
Parag Bagul


Step to Reproduce:

1.Download FlatPress CMS from a trusted source.

2.Start a local PHP server using the command: php -S 127.0.0.1:80

3.Open the following URL in your browser: https://127.0.0.1/setup.php

4.In the "username" field, enter the following payload: 

```html
tes"><img src=x onload=alert(1)>

'''

5.Click on the "Next" button.

6.A pop-up with the number "1" will appear on the screen, indicating the successful execution of the payload.
File Snapshot

[4.0K] /data/pocs/d5c36c2ad7e1608e420407800b76ce3bddd18342 ├── [123K] flatpreess_username_parameter.png ├── [119K] payload_execute_poc.png └── [1.1K] README.md 0 directories, 3 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.