https://pwnwiki.com/index.php?action=history&feed=atom&title=CVE-2021-27308_4Images_1.8_XSS%E6%BC%8F%E6%B4%9E 2026-04-27T10:31:56Z Revision history for this page on the wiki MediaWiki 1.35.1 https://pwnwiki.com/index.php?title=CVE-2021-27308_4Images_1.8_XSS%E6%BC%8F%E6%B4%9E&diff=3930&oldid=prev 2021-06-04T01:16:56Z

<p>Created page with &quot;&lt;pre&gt; # Exploit Title: 4Images 1.8 - &#039;redirect&#039; Reflected XSS # Exploit Author: Piyush Patil # Vendor Homepage: https://www.4homepages.de/ # Software Link: https://www.4homepa...&quot;</p> <p><b>New page</b></p><div>&lt;pre&gt;<br /> # Exploit Title: 4Images 1.8 - 'redirect' Reflected XSS<br /> # Exploit Author: Piyush Patil<br /> # Vendor Homepage: https://www.4homepages.de/<br /> # Software Link: https://www.4homepages.de/?download=4images1.8.zip&amp;code=81da0c7b5208e172ea83d879634f51d6<br /> # Version: 4Images Gallery 1.8<br /> # Tested on: Windows 10 and Kali<br /> # CVE : CVE-2021-27308<br /> <br /> -Description:<br /> A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the &quot;redirect&quot; parameter.<br /> <br /> <br /> -Steps to reproduce:<br /> 1- Goto 4images admin panel page (demo instance: https://localhost/4images/admin/index.php)<br /> 2- Enter the credentials , Turn on the intercept and click on &quot;Login&quot;<br /> 3- copy paste the XSS payload after redirect=./../admin/index.php%3Fsessionid=xxxxxPASTEPAYLOADHERE<br /> 4-Forward the request and you can see XSS is triggered.<br /> &lt;/pre&gt;</div>

Pwnwiki