Exploitation Summary
EIP tracks 2 public exploits for CVE-2024-35540. PoCs published by cyberaz0r.
AI-analyzed exploit summary This exploit leverages a stored XSS vulnerability in Typecho 1.3.0 to inject malicious JavaScript, which then modifies the theme editor to include a PHP webshell. The attacker can execute arbitrary commands via an interactive shell.
Description
A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Exploits (2)
This exploit leverages a stored XSS vulnerability in Typecho 1.3.0 to inject malicious JavaScript, which then modifies the theme editor to include a PHP webshell. The attacker can execute arbitrary commands via an interactive shell.
The repository contains functional exploit code for CVE-2024-35540, targeting Typecho <= 1.3.0. The exploit demonstrates a race condition vulnerability by spamming comments with spoofed client IPs, leveraging JavaScript token calculation and concurrent HTTP requests.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H