CVE-2020-35241

MEDIUM

FlatPress 1.0.3 - Stored Cross-Site Scripting in Blog Content

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-35241. PoCs published by Alperen Ergel.

AI-analyzed exploit summary This exploit demonstrates a persistent XSS vulnerability in Flatpress 1.0.3 by injecting malicious JavaScript into the 'content' parameter of a blog entry. The payload is executed when the entry is viewed.

Description

FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can steal the cookie according to the crafted payload.

Exploits (1)

exploitdb WORKING POC

by Alperen Ergel · textwebappsphp

https://www.exploit-db.com/exploits/48826

View Code ZIP pw:eip

This exploit demonstrates a persistent XSS vulnerability in Flatpress 1.0.3 by injecting malicious JavaScript into the 'content' parameter of a blog entry. The payload is executed when the entry is viewed.

Classification

Working Poc 95%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Flatpress 1.0.3

Auth required

Prerequisites: Authenticated session · Access to the admin panel

MITRE ATT&CK