theexploiters/cve-2024-39123-exploitExploit For: CVE-2024-39123: Stored XSS in Calibre-web 0.6.21
Calibre-web 0.6.21 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw allows an attacker to inject and store malicious scripts on the server. These scripts are subsequently executed in the context of another user's session when they access the infected part of the application.
Log In: Authenticate to the Calibre-web application with a valid user account.
Upload a New Book: Navigate to the upload section and upload a new book.
Access Books List: Visit the /table?data=list&sort_param=stored endpoint to view the Books List.
Inject Payload: In the Comments field of the uploaded book, insert the following payload:
<a href=javas%1Bcript:alert()>Hello there!</a>
Save Changes: Submit the form to save the changes.
Trigger the Payload: Go to the Book Details of the uploaded book. Click on the description to trigger the stored script. An alert box will appear, indicating the successful execution of the injected script.
This vulnerability allows attackers to execute arbitrary JavaScript in the context of other users. This can lead to:
