PublishWave — XSS via HTTP Cache Poisoning

hackadvisor

Task: PublishWave CMS with JSONP localization endpoint behind Nginx cache that excludes UTM params from cache keys. Solution: Exploit semicolon parameter splitting discrepancy between Nginx and Express to inject malicious callback via utm_content, poisoning the cache to achieve stored XSS and exfiltrate admin flag.