CVE-2023-42362 PoC — Teller 跨站脚本漏洞

Source

https://github.com/Mr-n0b3dy/CVE-2023-42362

Associated Vulnerability

Title:Teller 跨站脚本漏洞 (CVE-2023-42362)
Description:An arbitrary file upload vulnerability in Teller Web App v.4.4.0 allows a remote attacker to execute arbitrary commands and obtain sensitive information via uploading a crafted file.

Readme

# CVE-2023-42362
# Author: Abdelrahman Mohamed (Mr-n0b3dy)
## Linked-in: https://www.linkedin.com/in/abdelrhman-mohamed-ashraf-7bb43410b/
## Vulnerability Name: Unrestricted File Upload that led to ATO
## Severity: High
## Product: NCR teller web app
## Version: 4.4.0
## Description:
The Unrestricted File Upload leading to Stored Cross-Site Scripting (XSS) vulnerability is a security issue identified within the web application. This vulnerability arises due to a lack of proper input validation in the file upload functionality.
## Impact:
Attackers can upload a malicious file containing JavaScript code that enables them to hijack the admin session, which is already stored in the local storage. This breach could result in an account takeover of the admin account, granting them full access to administrator functionalities.
## Recommendations:
Install the latest version of the NCR Teller web app.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →