CVE-2020-25399 PoC — Mind iMind Server 跨站脚本漏洞

Source

https://github.com/h3llraiser/CVE-2020-25399

Associated Vulnerability

Title:Mind iMind Server 跨站脚本漏洞 (CVE-2020-25399)
Description:Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat.

Description

Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat.

Readme

# CVE-2020-25399
Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat.
# Information

Description: Attacker can send malicious file to any user using chat functional. File may contain js payload, which executes in victim's browser after file opens.

Researcher: Andrey Skuratov (https://github.com/h3llraiser/)

Issue date: 2020-07-06 (Initial Advisory)

Public release:

VEL Link: Info will be soon

NIST CVE Link: Info will be soon


# Screenshots:

![](POC_1_1.png)
![](POC_1_2.png)

File Snapshot


 [4.0K]  /data/pocs/89e397c8d16b34eae26b6e4a0e28be5b79b4acf0
├── [7.9K]  POC_1_1.png
├── [ 23K]  POC_1_2.png
└── [ 576]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!