.. / CVE-2020-25495

Exploit for Xinuo Openserver 5/6 - Cross-Site scripting (CVE-2020-25495)

Description:

Xinuo (formerly SCO) Openserver versions 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter ‘section’ and is vulnerable to reflected cross-site scripting.

Nuclei Template

View the template here CVE-2020-25495.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-25495.yaml
Copy

References:

https://github.com/ARPSyndicate/cvemon
https://nvd.nist.gov/vuln/detail/CVE-2020-25495
https://github.com/Ramikan/Vulnerabilities/blob/master/SCO%20Openserver%20XSS%20%26%20HTML%20Injection%20vulnerability
https://www.exploit-db.com/exploits/49300
http://packetstormsecurity.com/files/160634/SCO-Openserver-5.0.7-Cross-Site-Scripting.html