CVE-2023-4136 PoC — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4136.yaml

Associated Vulnerability

Title:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine (CVE-2023-4136)
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.

Description

CrafterCMS Engine is vulnerable to reflected cross-site scripting (XSS) via the transformerName parameter in the /api/1/site/url/transform endpoint, allowing attackers to execute arbitrary JavaScript in the context of the user.

File Snapshot


 id: CVE-2023-4136

info:
  name: CrafterCMS Engine - Cross-Site Scripting
  author: ritikchaddha
  s

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →