CVE-2020-14294 PoC — Secudos Qiata FTA 跨站脚本漏洞

Source

https://github.com/patrickhener/CVE-2020-14294

Associated Vulnerability

Title:Secudos Qiata FTA 跨站脚本漏洞 (CVE-2020-14294)
Description:An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board.

Description

This repository holds the advisory of the CVE-2020-14294

Readme

# CVE-2020-14294

This vulnerablity was discovered and disclosed by me. This repository will hold the advisory.

This repository is only for educational purposes.

# Links

- [Advisory SYSS-2020-024](https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-024.txt)
- [Detailed writeup](https://hesec.de/posts/cve-2020-14293a14294/)
- [SySS Blog entry](https://www.syss.de/pentest-blog/syss-2020-024-und-syss-2020-025-zwei-schwachstellen-in-file-transfer-loesung-von-qiata)
- [Vendor notice](https://www.secudos.de/news-und-events/aktuelle-news/sicherheitsluecken-in-domos-und-qiata-2-0-behoben)
- [MITRE Entry](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14294)
- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2020-14294)

File Snapshot


 [4.0K]  /data/pocs/296f66946bd9b2ae527e854b7f19d3eebcdbcda2
├── [4.0K]  advisory
│   └── [4.8K]  SYSS-2020-024.txt.asc
└── [ 756]  README.md

1 directory, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!