0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
PDW File Browser 1.3 - (new_filename) Cross-Site Scripting Vulnerability
[# Exploit Title: PDW File Browser <= v1.3 - Cross-Site Scripting (XSS) # Exploit Author: David Bimmel # Researchers: David Bimmel, Joost Vondeling, Ramòn Janssen # Vendor Homepage: n/a # Software Link: https://github.com/GuidoNeele/PDW-File-Browser # Version: <=1.3 The PDW File Browser is a plugin for the TinyMCE and CKEditor WYSIWYG editors. The PDW File Browser contains a stored and Reflected XSS vulnerability which results in code execution within the browser of an authenticated user. This vulnerability can be exploited when an authenticated user visits the crafted URL (i.e. when phished or when visiting a website containing the URL). Stored XSS: The stored XSS is a result of insufficient input sanitization within the 'rename' functionality within the PDW file browser. Below I have provided an example request were the filename (FILE.txt) is replaced with an XSS payload (<svg onload=alert(document.cookies)>). The payload gets executed when any authenticated user navigates to the PDW File browser page. POST /ckeditor/plugins/pdw_file_browser/actions.php HTTP/1.1 Host: <HOSTNAME> […] action=rename&new_filename=<svg+onload=alert(document.cookie s)>&old_filename=script%253EFILE.txt&folder=%252Fmedia%252F&typ e=file Reflected XSS: The Reflected XSS is a result of insufficient input sanitization of the 'path' parameter when fetching the file specifications (file_specs.php). Below I have provided an example URL. When using this URL the user navigates to an non-existing file (the XSS payload). This results in the execution of the payload. https://<HOSTNAME>/ckeditor/plugins/pdw_file_browser/file_spe cs.php?ajax=true&path=%3Csvg+onload=alert(document.cookies)% 3E&type=file Happy Hacking :^) # 0day.today [2024-11-15] #