Skip to content

CVE-2021-45745 - A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in login panel. Application stores attacker injected dangerous JavaScript in to the database and executes without validating.

Notifications You must be signed in to change notification settings

plsanu/Bludit-3.13.1-About-Plugin-Stored-Cross-Site-Scripting-XSS

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
 
 

Repository files navigation

CVE-2021-45745

Exploit Title: Bludit 3.13.1 - About Plugin Stored Cross Site Scripting (XSS)

Exploit Author: P.L.Sanu

CVE: CVE-2021-45745

CVSS: 5.4 MEDIUM

References:

Description:

A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in login panel. Application stores attacker injected dangerous JavaScript in to the database and executes without validating.

Exploit:

  1. Login to the admin panel http://localhost/admin
  2. Navigate to Themes section.
  3. Activate the Blog X theme.
  4. Navigate to plugins section.
  5. In About plugin click the Settings button.
  6. Inject the below payload in About section.

Payload:

"><script>alert("XSS")</script>
  1. Click on Save button.
  2. Visit the site.
  3. Malicious javascript code triggered.

Impact:

An attacker can able to inject malicious JavaScript code in About Plugin.

Mitigation:

It is recommended to sanitize all the input fields throughout the application.

About

CVE-2021-45745 - A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in login panel. Application stores attacker injected dangerous JavaScript in to the database and executes without validating.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published