CVE-2018-25331
MEDIUMZenar Content Management System Cross-Site Scripting via ajax.php
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2018-25331. PoCs published by Berk Dusunur.
AI-analyzed exploit summary This is a functional proof-of-concept for a stored XSS vulnerability in Zenar CMS. The exploit demonstrates how an attacker can inject malicious JavaScript via the 'current_page' parameter in an AJAX request, which is then reflected in the response.
Description
Zenar Content Management System contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating form parameters in POST requests. Attackers can inject script tags through the current_page parameter sent to the ajax.php endpoint, which reflects unsanitized user input in the response HTML to execute arbitrary JavaScript in victim browsers.
Exploits (1)
This is a functional proof-of-concept for a stored XSS vulnerability in Zenar CMS. The exploit demonstrates how an attacker can inject malicious JavaScript via the 'current_page' parameter in an AJAX request, which is then reflected in the response.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N