CVE-2020-16270
MEDIUMOLIMPOKS < 3.3.39 - Authenticated Cross-Site Scripting via Error Message
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-16270. PoCs published by Security-AVS.
AI-analyzed exploit summary This repository provides a writeup and proof-of-concept for CVE-2020-16270, an XSS vulnerability in OLIMPOKS versions under 3.3.39. The vulnerability allows remote attackers to inject malicious JavaScript payloads via the ErrorMessage parameter in the Auth/Admin endpoint.
Description
OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of targeted application and perform phishing-related attacks. Vulnerable application used in more than 3000 organizations in different sectors from retail to industries.
Exploits (1)
This repository provides a writeup and proof-of-concept for CVE-2020-16270, an XSS vulnerability in OLIMPOKS versions under 3.3.39. The vulnerability allows remote attackers to inject malicious JavaScript payloads via the ErrorMessage parameter in the Auth/Admin endpoint.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N