htmly 2.9.9 Cross Site Scripting ≈ Packet Storm

Home ^[1] Files ^[2] News ^[3] &[SERVICES_TAB] Contact ^[4] Add New ^[5]

htmly 2.9.9 Cross Site Scripting^[6]: Authored by Andrey Stoykov ^[7] | Site msecureltd.blogspot.com ^[8]; htmly version 2.9.9 suffers from multiple persistent cross site scripting vulnerabilities.; SHA-256 | b19a6a9192ab7fdb974bbaace4e6310aa155520d7f2a2c087e43a0e209b862b0; Download ^[9] | Favorite ^[10] | View ^[11]

# Exploit Title: Stored XSS in "Edit Profile" - htmlyv2.9.9
# Date: 9/2024
# Exploit Author: Andrey Stoykov
# Version: 2.9.9
# Tested on: Ubuntu 22.04
# Blog:
https://msecureltd.blogspot.com/2024/09/friday-fun-pentest-series-11-stored-xss.html
Stored XSS #1:
Steps to Reproduce:
1. Login as author
2. Browse to "Edit Profile"
3. In "Content" field add payload "><img src=x onerror=alert(1)>
4. Then refresh the "Edit Profile" page
# Exploit Title: Stored XSS in "Menu Editor" - htmlyv2.9.9
# Date: 9/2024
# Exploit Author: Andrey Stoykov
# Version: 2.9.9
# Tested on: Ubuntu 22.04
# Blog:
https://msecureltd.blogspot.com/2024/09/friday-fun-pentest-series-10-stored-xss.html
Stored XSS #1:
Steps to Reproduce:
1. Login as admin
2. Browse to "Menu Editor"
3. In "Name" field add payload "><img src=x onerror=alert(1)>
4. In "Slug" field add payload "><img src=x onerror=alert(1)>
5. Click "Save Edit" > "Save Menu"