Vulners
Lucene search
b2evolution 6.11.6 - 'tab3' Reflected XSS
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | CVE-2020-22839 | 14 Nov 202406:08 | – | circl |
 | B2evolution Cms Cross-Site Scripting Vulnerability | 9 Feb 202100:00 | – | cnnvd |
 | CVE-2020-22839 | 9 Feb 202119:39 | – | cve |
 | CVE-2020-22839 | 9 Feb 202119:39 | – | cvelist |
 | EUVD-2020-15596 | 7 Oct 202500:30 | – | euvd |
 | CVE-2020-22839 | 9 Feb 202120:15 | – | nvd |
 | b2evolution < 6.11.7 Multiple Vulnerabilities | 11 Feb 202100:00 | – | openvas |
 | b2evolution CMS 6.11.6 Cross Site Scripting | 10 Feb 202100:00 | – | packetstorm |
 | Cross site scripting | 9 Feb 202120:15 | – | prion |
 | CVE-2020-22839 | 22 May 202517:00 | – | redhatcve |
10
# Exploit Title: b2evolution 6.11.6 - 'tab3' Reflected XSS
# CVE: CVE-2020-22839
# Date: 10/02/2021
# Exploit Author: Nakul Ratti, Soham Bakore
# Vendor Homepage: https://b2evolution.net/
# Software Link: https://b2evolution.net/downloads/6-11-6-stable?download=12405
# Version: 6.11.6
# Tested on: latest version of Chrome, Firefox on Windows and Linux
--------------------------Proof of Concept-----------------------
Steps to Reproduce:
1. Send the following URL http://HOST/evoadm.php?.ctrl=comments&filter=restore&tab3=123%22onmouseover=%22alert(document.domain)%22&blog=1&blog=1 to the logged in victim using any social engineering technique.
2. When an unsuspecting user with high privileges opens this URL, XSS will be triggered which will execute the malicious javascript payload in users browser.
3. The vulnerable parameter in this case is “tab3”.Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
11 Feb 2021 00:00Current
6.3Medium risk
Vulners AI Score6.3
CVSS 24.3
CVSS 3.16.1
EPSS0.01038