CVE-2021-46067
CRITICALIn Vehicle Service Management System 1.0 - Info Disclosure
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2021-46067. PoCs published by sanupl, plsanu.
AI-analyzed exploit summary This repository provides a functional proof-of-concept for CVE-2021-46067, demonstrating how an attacker can steal cookies via malicious HTML file uploads in the Vehicle Service Management System, leading to full account takeover.
Description
In Vehicle Service Management System 1.0 an attacker can steal the cookies leading to Full Account Takeover.
Exploits (3)
This repository provides a functional proof-of-concept for CVE-2021-46067, demonstrating how an attacker can steal cookies via malicious HTML file uploads in the Vehicle Service Management System, leading to full account takeover.
This repository provides a functional proof-of-concept for CVE-2021-46067, demonstrating how an attacker can steal cookies via malicious HTML file uploads in the Vehicle Service Management System, leading to full account takeover.
This PoC demonstrates a cookie-stealing vulnerability in Vehicle Service Management System 1.0, leading to full account takeover via malicious HTML file uploads in multiple sections (MyAccount, User List, Settings). The exploit leverages XSS to exfiltrate session cookies to a third-party webhook.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H