CVE-2021-36646

MEDIUMNuclei

KodExplorer - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-36646 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A Cross Site Scrtpting (XSS) vulnerability in KodExplorer 4.45 allows remote attackers to run arbitrary code via /index.php page.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 26, 2024 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryMEDIUMKodExplorer - Cross-Site ScriptingCVSS 6.1

KodExplorer is susceptible to a reflected cross-site scripting (XSS) vulnerability in the file view functionality.The vulnerability exists in app/template/api/view.html where user-supplied input in the 'path' parameter is directly echoed without proper sanitization.This allows attackers to inject malicious JavaScript code that executes in the context of the user's browser.

Impact

Attackers can inject malicious JavaScript via XSS in the path parameter, potentially stealing user session cookies or performing unauthorized actions.

Remediation

Upgrade to the latest version of KodExplorer that addresses this vulnerability. Implement proper input validation and output encoding for user-supplied data.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2021xsskodexplorervuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
FOFA: app="Powered-by-KodExplorer"
https://github.com/kalcaddle/KodExplorer/issues/482 https://nvd.nist.gov/vuln/detail/CVE-2021-36646

Source: ProjectDiscovery

References

2