关联漏洞
标题：
N/A
(CVE-2024-54951)
描述：Monica 4.1.2 存在跨站脚本（XSS）漏洞。恶意用户可以创建一个畸形的联系人，并在“HOW YOU MET”自定义选项中使用该联系人以触发XSS攻击。
描述
I contacted the monica development team via email on 11/20/2024. I also contacted them via LinkedIn, and other platforms in the weeks that followed. Publishing here since there was no response.
介绍
# Monica-Stored-XSS-Vulnerability
## CVE-2024-54951
I contacted the monica development team via email on 11/20/2024. I also contacted them via LinkedIn through connection message attempt, and other platforms in the weeks that followed. Publishing here since there was no response after 3 months of time.
## Monica Docker v. 4.1.2 Stored XSS Vulnerability
1) First hit the contacts button in the top pane
2) On the right hand side click [Add someone]
3) enter your XSS payload into all of the name fields as they are all vulnerable. You need to use double quotes for your payloads single quotes seem to break the web application.
4) then on the left hand pane click the HOW YOU MET url.
5) Then select the contact that has your javascript payloads under the "Has someone introduced you to this person?" drop down list. Then hit save.
6) See the javascript payload in the contact page for the person you made executed under the "HOW YOU MET" box.
文件快照
[4.0K] /data/pocs/e29e5a2cd37983714ac5ad3bc0f0a468b6b60b5d
└── [1.5K] README.md
0 directories, 1 file
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。