Description
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val parameter in mode=add_todo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection, executing script in the admin panel origin.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
MacWarrior clipbucket-v5
Default version status: unaffected
0 to ≤ 5.5.3-#206affected
pkg:github/MacWarrior/clipbucket-v5References
- https://hackmd.io/@leediay/BJR_lh2ifg ↗
- https://github.com/MacWarrior/clipbucket-v5/blob/01990c0fa7baf925d2a4cf6ec1b75b1341b7a486/upload/admin_area/index.php#L16-L25 ↗
- https://github.com/MacWarrior/clipbucket-v5/commit/b251858e06ba2895a845497fb2e84fcd083f6f63 ↗
- https://github.com/MacWarrior/clipbucket-v5 ↗
- https://www.vulncheck.com/advisories/clipbucket-v5-through-5.5.3-206-reflected-xss-via-add-todo-val-parameter ↗