Reflected Cross Site Scripting in WolfCMS Allows Session Hijacking and Remote Browser Control
CVE-2018-1000087
4.8MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2018-1000087?
WolfCMS version 0.8.3.1 is vulnerable to reflected cross site scripting through the 'Create New File' and 'Create New Directory' input fields found in the 'files' Tab. An attacker can exploit this vulnerability by injecting malicious JavaScript, leading to potential session hijacking and the ability to control user browsers remotely. This risk highlights the importance of input sanitization for web applications, particularly in file management interfaces.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.