Plone CMS 5.2.3 Cross Site Scripting ≈ Packet Storm – Digitalmunition




Exploit/Advisories no-image-featured-image.png

Published on March 20th, 2021 📆 | 5277 Views ⚑

0

Plone CMS 5.2.3 Cross Site Scripting ≈ Packet Storm

Plone CMS 5.2.3 Cross Site Scripting
Posted Mar 19, 2021
Authored by Piyush Patil

Plone CMS version 5.2.3 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
MD5 | 3a719e2cb04b1291bdd2eec8fe2b9f60
# Exploit Title: Plone CMS 5.2.3 - 'Title' Stored XSS
# Date: 18-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://plone.com/
# Software Link: https://github.com/plone/Products.CMFPlone/tags
# Version: 5.2.3
# Tested on: Windows 10

# Reference - https://github.com/plone/Products.CMFPlone/issues/3255

Steps to reproduce the issue:
1- Goto https://localhost/ where Plone 5.2.3 version is installed.
2- Click on "Log in now" and Login as "Manager"
3- Navigate to Manager=>Site Setup=>Site
4- Edit "Site title" field to "xyz"

Source link

Tagged with:



Leave a Reply