CVE-2024-50803 PoC — Redaxo 安全漏洞

Source

https://github.com/Praison001/CVE-2024-50803-Redaxo

Associated Vulnerability

Title:Redaxo 安全漏洞 (CVE-2024-50803)
Description:The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privileges

Description

Stored XSS in mediapool feature of Redaxo

Readme

# CVE-2024-50803
Stored XSS in mediapool feature of Redaxo

A stored cross-site scripting (XSS) vulnerability was found in Redaxo versions < 5.18.0, allowing attackers with sufficient privileges to upload a malicious SVG file through the mediapool feature.

**Published a write-up**: https://medium.com/@praison66/5d15a3cd054d

Discovered by **Praison**, Sep 2024.

**References**:
    https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=CVE-2024-50803
    https://github.com/redaxo/redaxo/releases/tag/5.18.0

**Vulnerable versions**: < 5.18.0

**Fix**: Update Redaxo to the latest version - 5.18.0

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!