Skip to content

Instantly share code, notes, and snippets.

@damodarnaik

damodarnaik/CVE-2022-45437.md

Created October 17, 2023 17:14
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save damodarnaik/06180e8a5aa237b38740486b3e398011 to your computer and use it in GitHub Desktop.
Save damodarnaik/06180e8a5aa237b38740486b3e398011 to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2022-45437
Raw
CVE-2022-45437.md

CVE-2022-45437

# Vulnerability Title: Stored Cross Site Scripting - Dashboard Module
# Vendor Homepage: https://pandorafms.com/en/
# Version: <= v765
# CVE: CVE-2022-45437
# CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (4.8 Medium)
# Exploit Author: Damodar Naik
# Date: 02/14/2023

Steps to reproduce:

  1. Create new Dashboard by navigating to Reporting -> Dashbord as an attacker.
  2. Create a new Dashboard by selecting group as web, and by adding XSS payload in name parameter.
  3. Browse the application as admin (belongs to all group) or other users from web group.
  4. The XSS payload will be executed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment