CVE-2021-47835
HIGHFreeter 1.2.1 - Stored Cross-Site Scripting via Custom Widget Titles and Files
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-47835. PoCs published by TaurusOmar.
AI-analyzed exploit summary This is a functional XSS exploit for Freeter 1.2.1, leveraging an audio tag with an onerror handler to execute arbitrary JavaScript. The payload spawns a reverse shell via netcat and executes system commands.
Description
Freeter 1.2.1 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads in custom widget titles and files. Attackers can craft malicious files with embedded scripts that execute when victims interact with the application, potentially enabling remote code execution.
Exploits (1)
This is a functional XSS exploit for Freeter 1.2.1, leveraging an audio tag with an onerror handler to execute arbitrary JavaScript. The payload spawns a reverse shell via netcat and executes system commands.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N