CVE-2021-47843
MEDIUMTagstoo 2.0.1 - Stored Cross-Site Scripting via File or Custom Tag Injection
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-47843. PoCs published by TaurusOmar.
AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in Tagstoo 2.0.1 that can be leveraged to achieve remote code execution (RCE) via Node.js process binding or child_process execution. The payloads are encoded to bypass basic input validation and execute arbitrary commands.
Description
Tagstoo 2.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious payloads through files or custom tags. Attackers can execute arbitrary JavaScript code to spawn system processes, access files, and perform remote code execution on the victim's computer.
Exploits (1)
This exploit demonstrates a stored XSS vulnerability in Tagstoo 2.0.1 that can be leveraged to achieve remote code execution (RCE) via Node.js process binding or child_process execution. The payloads are encoded to bypass basic input validation and execute arbitrary commands.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N