.. / CVE-2020-20285

Exploit for ZZcms - Cross-Site Scripting (CVE-2020-20285)

Description:

ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks.

Nuclei Template

View the template here CVE-2020-20285.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-20285.yaml
Copy

References:

https://github.com/ARPSyndicate/kenzer-templates
https://nvd.nist.gov/vuln/detail/CVE-2020-20285
https://github.com/iohex/ZZCMS/blob/master/zzcms2019_login_xss.md