CVE-2024-53255
MEDIUMBoidCMS < 2.1.2 - Reflected Cross-Site Scripting via Media File Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-53255. PoCs published by 0x4M3R.
AI-analyzed exploit summary This repository contains a proof-of-concept for a reflected XSS vulnerability in Boid CMS 2.1.1. The exploit leverages the 'file' parameter in the /admin?page=media endpoint to inject arbitrary JavaScript code, demonstrated via an SVG onload event.
Description
BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting (XSS) vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code. This code could be used to steal the user's session cookie, perform phishing attacks, or deface the website. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Exploits (1)
This repository contains a proof-of-concept for a reflected XSS vulnerability in Boid CMS 2.1.1. The exploit leverages the 'file' parameter in the /admin?page=media endpoint to inject arbitrary JavaScript code, demonstrated via an SVG onload event.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N