CVE-2023-36809: POC Misconfigured HTTP headers allowing Stored XSS in KiwiTCMS- @mnqazi #MNadeemQazi

I successfully identified a Stored XSS vulnerability within kiwitcms/kiwi. The vulnerability lies in the handling of files uploaded to the application. By utilizing a specific payload within the html file, an attacker can inject arbitrary code that will be executed within the context of the affected application.
It was patched by the vendor, and assigned a CVE-2023-36809.

Reported By: #M_Nadeem_Qazi
Report Link: https://huntr.dev/bounties/511489dd-ba38-4806-9029-b28ab2830aa8/
Github: https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-jpgw-2r9m-8qfw

Follow me:
Facebook: @mnqazi
Instagram: @mnqazi
Twitter: @mnqazi

Скачать видео