CVE-2021-47841
MEDIUMSnipCommand 0.1.0 - Stored Cross-Site Scripting via File or Title Input
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-47841. PoCs published by TaurusOmar.
AI-analyzed exploit summary This exploit leverages an XSS vulnerability in SnipCommand 0.1.0 to achieve RCE by embedding a malicious payload in an audio tag's onerror event. The payload executes a reverse shell via netcat and spawns a calculator as a secondary action.
Description
SnipCommand 0.1.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into command snippets. Attackers can execute arbitrary code by embedding malicious JavaScript that triggers remote command execution through file or title inputs.
Exploits (1)
This exploit leverages an XSS vulnerability in SnipCommand 0.1.0 to achieve RCE by embedding a malicious payload in an audio tag's onerror event. The payload executes a reverse shell via netcat and spawns a calculator as a secondary action.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N