CVE-2021-47836
MEDIUMMarkdown Explorer 0.1.1 - Stored Cross-Site Scripting via File Upload
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-47836. PoCs published by Taurus Omar.
AI-analyzed exploit summary This exploit leverages an XSS vulnerability in Markdown Explorer 0.1.1 to achieve RCE by embedding a malicious payload in a markdown file. The payload executes a reverse shell via netcat and spawns a calculator as a proof of concept.
Description
Markdown Explorer 0.1.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through file uploads and editor inputs. Attackers can upload markdown files with embedded JavaScript payloads that execute in the application's privileged renderer context, allowing code execution on the host.
Exploits (1)
This exploit leverages an XSS vulnerability in Markdown Explorer 0.1.1 to achieve RCE by embedding a malicious payload in a markdown file. The payload executes a reverse shell via netcat and spawns a calculator as a proof of concept.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N