CVE-2021-47716
MEDIUMOrangescrum 1.8.0 - Authenticated Cross-Site Scripting via Input Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-47716. PoCs published by Hubert Wojciechowski.
AI-analyzed exploit summary This exploit demonstrates authenticated reflected and stored XSS vulnerabilities in OrangeScrum 1.8.0. The PoC includes HTTP requests with malicious payloads injected into parameters like 'projid' and 'CS_message', triggering JavaScript execution.
Description
Orangescrum 1.8.0 contains multiple cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through various input parameters. Attackers can exploit parameters like 'projid', 'CS_message', and 'name' to execute arbitrary JavaScript code in victim's browsers by submitting crafted payloads through application endpoints.
Exploits (1)
This exploit demonstrates authenticated reflected and stored XSS vulnerabilities in OrangeScrum 1.8.0. The PoC includes HTTP requests with malicious payloads injected into parameters like 'projid' and 'CS_message', triggering JavaScript execution.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N