Monitorr 1.7.6 Cross Site Scripting – Torchsec

# Exploit Title: Monitorr v1.7.6 - Cross Site Scripting
# CVE: CVE-2023-26776
# Exploit Author: Achuth V P (retrymp3)
# Date: February 09, 2023
# Vendor Homepage: https://github.com/Monitorr/
# Software Link: https://github.com/Monitorr/Monitorr
# Tested on: Ubuntu
# Version: v1.7.6
# Exploit Description:  Cross Site Scripting vulnerability found in Monitorr v.1.7.6 allows a remote attacker to execute arbitrary code via the title parameter of the post_receiver-services.php file.
Attacker can create a service configuration at /assets/php/post_receiver-services.php with the title of the service being something like;  or just 
The injected script tag is executed everytime the home page is loaded.

Comments are closed.