CVE-2019-25731
MEDIUMZuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2019-25731. PoCs published by Deyaa Muhammad.
AI-analyzed exploit summary This exploit demonstrates a persistent XSS vulnerability in Zuz Music 2.1 by injecting malicious JavaScript into the 'name', 'subject', and 'message' parameters of the contact form. The payload is executed when an administrator views the message in the admin inbox.
Description
Zuz Music 2.1 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript by submitting crafted contact form data. Attackers can inject script code through the name, subject, and message parameters in POST requests to /gmusic/zuzconsole/___contact, which executes when administrators view messages in the inbox interface.
Exploits (1)
This exploit demonstrates a persistent XSS vulnerability in Zuz Music 2.1 by injecting malicious JavaScript into the 'name', 'subject', and 'message' parameters of the contact form. The payload is executed when an administrator views the message in the admin inbox.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N