Headline
CVE-2021-45018: There is a stored xss vulnerability exists in catfish - <=6.3.0. · Issue #9 · xwlrbh/Catfish
Cross Site Scripting (XSS) vulnerability exists in Catfish <=6.3.0 via a Google search in url:/catfishcms/index.php/admin/Index/addmenu.htmland then the .html file on the website that uses this editor (the file suffix is allowed).
[Suggested description]
Cross SIte Scripting (XSS) vulnerability exists in catfish - <=6.3.0. via
a Google search inurl:/catfishcms/index.php/admin/Index/addmenu.htmland then the .html
file on the website that uses this editor (the file suffix is allowed).
[Vulnerability Type]
Cross Site Scripting (XSS)
[Vendor of Product]
https://github.com/xwlrbh/Catfish
[Affected Product Code Base]
catfish - <=6.3.0.
[Affected Component]
POST /catfishcms/index.php/admin/Index/addmenu.html HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
…
zidingyi=your xss url
[Attack Type]
Remote
[Impact Code execution]
true
