Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-0578: Code Injection in publify

Code Injection in GitHub repository publify/publify prior to 9.2.8.

CVE
#web#google#js#git

Description

The application doesn’t check/filter the comments provided by the user before save to database. Attacker can’t insert js code to steal admin’s data but can insert html code, leads to many information security risks.

Proof of Concept

  • Step 1: Go to https://demo-publify.herokuapp.com/2022/02/11/hello-world#comments and comment in anonymous user.

    <img src=https://www.technistone.com/color-range/image-slab/Starlight%20Black_SLAB_web.jpg width="2000" height="2000">

  • Step 2: Login as demo user, go to https://demo-publify.herokuapp.com/admin/feedback. You can see html code has been rendered successfully.
  • PoC: https://drive.google.com/file/d/1RSuq7fsyJPrbNHqlZ9pRW3lgXAvmOrQf

Impact

Attacker can insert html code to break the website format, phishing or collect the admin’s IP through loading images in img tags.

Related news

CVE-2022-42984: GitHub - nhiephon/Research

WoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=search&s=recipients.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907