Exploit/Advisories no image

Published on June 4th, 2024 📆 | 5937 Views ⚑

0

Sitefinity 15.0 Cross Site Scripting – Torchsec


Convert Text to Speech

# Exploit Title: Sitefinity 15.0 - Cross-Site Scripting (XSS)
# Date: 2023-12-05
# Exploit Author: Aldi Saputra Wahyudi
# Vendor Homepage: https://www.progress.com/sitefinity-cms
# Version: < 15.0.0
# Tested on: Windows/Linux
# CVE : CVE-2023-27636

# Description: In the backend of the Sitefinity CMS, a Cross-site scripting vulnerability has been discovered in all features that use SF-Editor

# Steps To Reproduce:

Attacker as lower privilege
Victim as Higher privilege





1. Login as an Attacker
2. Go to the function using the SF Editor, go to the news page as example
3. Create or Edit news item
4. On the content form, insert the XSS payload as HTML
5. After the payload is inserted, click on the content form (just click) and publish or save
6. If the victim visits the page with XSS payload, XSS will be triggered

Payload:

Source link

Tagged with:



Leave a Reply

Your email address will not be published.