CVE-2021-47968
MEDIUMPodcast Generator 3.1 Persistent Cross-Site Scripting via long_description
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2021-47968. PoCs published by Ayşenur KARAASLAN.
AI-analyzed exploit summary This is a functional proof-of-concept for a persistent XSS vulnerability in Podcast Generator 3.1. The exploit demonstrates how an attacker can inject malicious JavaScript into the 'long_description' field, which is then executed when a user views the episode details.
Description
Podcast Generator 3.1 is vulnerable to persistent cross-site scripting, allowing authenticated attackers to inject malicious scripts by submitting unfiltered JavaScript code in the long_description parameter. Attackers can inject script tags through episode creation or editing requests to execute arbitrary JavaScript when other users view the episode details.
Exploits (1)
This is a functional proof-of-concept for a persistent XSS vulnerability in Podcast Generator 3.1. The exploit demonstrates how an attacker can inject malicious JavaScript into the 'long_description' field, which is then executed when a user views the episode details.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N