header-logo
Suggest Exploit
vendor:
Eve-ng
by:
@casp3r0x0 hassan ali al-khafaji
7.5
CVSS
HIGH
Stored Cross-Site Scripting (XSS)
79
CWE
Product Name: Eve-ng
Affected Version From: 5.0.1-13
Affected Version To: 5.0.1-13
Patch Exists: NO
Related CWE:
CPE: a:eve-ng:eve-ng:5.0.1-13
Metasploit:
Other Scripts:
Platforms Tested: Free EVE Community Edition Version 5.0.1-13
2022

Eve-ng 5.0.1-13 – Stored Cross-Site Scripting (XSS)

A stored XSS vulnerability was discovered in the Free EVE Community Edition Version 5.0.1-13 of Eve-ng. An attacker can create a new lab, create a Text label, insert a malicious XSS payload and click save. When any user opens the lab, the XSS will be triggered.

Mitigation:

Input validation should be used to prevent malicious code from being stored in the application.
Source

Exploit-DB raw data:

# Exploit Title: Eve-ng 5.0.1-13 - Stored Cross-Site Scripting (XSS) 
# Google Dork: N/A
# Date: 12/6/2022
# Exploit Author: @casp3r0x0 hassan ali al-khafaji
# Vendor Homepage: https://www.eve-ng.net/
# Software Link: https://www.eve-ng.net/index.php/download/
# Version: Free EVE Community Edition Version 5.0.1-13
# Tested on: Free EVE Community Edition Version 5.0.1-13
# CVE : N/A



#we could achieve stored XSS on eve-ng free I don't know If this
effect pro version also
#first create a new lab
#second create a Text label
#insert the xss payload and click save "><script>alert(1)</script>
#the application is multi user if any user open the lab the xss will be triggered.

Navigation

Suggest Exploit

Services By CQR