CVE-2021-3395 PoC — Pryaniki 跨站脚本漏洞

Source

https://github.com/jet-pentest/CVE-2021-3395

Associated Vulnerability

Title:Pryaniki 跨站脚本漏洞 (CVE-2021-3395)
Description:A cross-site scripting (XSS) vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary file. The JavaScript code will execute when someone visits the attachment.

Readme

# CVE-2021-3395
## [Suggested description]
A cross-site scripting (XSS) vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary file. The JavaScript code will execute when someone visits the attachment.

## [Vulnerability Type]
Cross Site Scripting (XSS)

## [Vendor of Product]
OOO  Tekhnologii zashchity

## [Affected Product Code Base]
PRYANIKY - 6.44.3

## [Attack Type]
Remote

## [Attack Vectors]
To exploit this vulnerability someone must open a crafted HTML file.

## [Has vendor confirmed or acknowledged the vulnerability?] true
true

## [Discoverer]
Irina Belyaeva (Jet Infosystems, jet.su), Maria Kononova (Jet Infosystems, jet.su)

## [Reference]
https://pryaniky.com/en/

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →