{"uuid": "5c1e3487-568c-442d-9b65-7965cf464d80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27308", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/11261", "content": "Exploit Collector\n4Images 1.8 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png \n4Images version 1.8 suffers from a cross site scripting vulnerability.\n\nMD5 | 4674a7f7a4902040e42fa9c804d23d17\n\nDownload\n# Exploit Title: 4Images 1.8 - 'redirect' Reflected XSS\n# Exploit Author: Piyush Patil\n# Vendor Homepage: https://www.4homepages.de/\n# Software Link: https://www.4homepages.de/?download=4images1.8.zip&code=81da0c7b5208e172ea83d879634f51d6\n# Version: 4Images Gallery 1.8\n# Tested on: Windows 10 and Kali\n# CVE : CVE-2021-27308\n\n-Description:\nA cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the \"redirect\" parameter.\n-Steps to reproduce:\n1- Goto 4images admin panel page (demo instance: https://localhost/4images/admin/index.php)\n2- Enter the credentials , Turn on the intercept and click on \"Login\"\n3- copy paste the XSS payload after redirect=./../admin/index.php%3Fsessionid=xxxxxPASTEPAYLOADHERE\n4-Forward the request and you can see XSS is triggered.\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T05:00:04.110006Z"}