Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!
CVE-2024-41503 — Proof-of-concept for CVE-2024-41503: stored cross-site scripting (XSS) vulnerability in Jetimob Plataforma Imobiliaria CRM/ERP/CMS. Demonstrates JavaScript injection via the search filter save function. | Kitploit
Proof-of-concept for CVE-2024-41503: stored cross-site scripting (XSS) vulnerability in Jetimob Plataforma Imobiliaria CRM/ERP/CMS. Demonstrates JavaScript injection via the search filter save function.
Software: Jetimob Plataforma Imobiliaria (CRM/ERP/CMS)
Version: 20240627-0
Vulnerability: Stored Cross-Site Scripting (XSS)
Description: The "Busca" (search) function used throughout the application contains a filter option that can be saved - when saving it, there is a "Título" form field that allows injection of JavaScript code, storing the code in the application. It is then executed when the filter is created or when clicking to delete it, when the deletion confirmation window containing the payload appears.