69f3ee7722
8 changes to exploits/shellcodes/ghdb Lucee 5.4.2.17 - Authenticated Reflected XSS Adlisting Classified Ads 2.14.0 - WebPage Content Information Disclosure Emagic Data Center Management Suite v6.0 - OS Command Injection mooSocial 3.1.8 - Reflected XSS PHPJabbers Vacation Rental Script 4.0 - CSRF Social-Commerce 3.1.6 - Reflected XSS Pyro CMS 3.9 - Server-Side Template Injection (SSTI) (Authenticated)
49 lines
No EOL
1.4 KiB
Text
49 lines
No EOL
1.4 KiB
Text
# Exploit Title: Adlisting Classified Ads 2.14.0 - WebPage Content Information Disclosure
|
|
# Exploit Author: CraCkEr
|
|
# Date: 25/07/2023
|
|
# Vendor: Templatecookie
|
|
# Vendor Homepage: https://templatecookie.com/
|
|
# Software Link: https://templatecookie.com/demo/adlisting-classified-ads-script
|
|
# Version: 2.14.0
|
|
# Tested on: Windows 10 Pro
|
|
# Impact: Sensitive Information Leakage
|
|
# CVE: CVE-2023-4168
|
|
|
|
|
|
## Description
|
|
|
|
Information disclosure issue in the redirect responses, When accessing any page on the website,
|
|
Sensitive data, such as API keys, server keys, and app IDs, is being exposed in the body of these redirects.
|
|
|
|
|
|
## Steps to Reproduce:
|
|
|
|
When you visit any page on the website, like:
|
|
|
|
https://website/ad-list?category=electronics
|
|
https://website/ad-list-search?page=2
|
|
https://website/ad-list-search?keyword=&lat=&long=&long=&lat=&location=&category=&keyword=
|
|
|
|
in the body page response there's information leakage for
|
|
|
|
+---------------------+
|
|
google_map_key
|
|
api_key
|
|
auth_domain
|
|
project_id
|
|
storage_bucket
|
|
messaging_sender_id
|
|
app_id
|
|
measurement_id
|
|
+---------------------+
|
|
|
|
|
|
Note: The same information leaked, such as the API keys, server keys, and app ID, was added to the "Firebase Push Notification Configuration" in the Administration Panel.
|
|
|
|
Settings of "Firebase Push Notification Configuration" in the Administration Panel, on this Path:
|
|
|
|
https://website/push-notification (Login as Administrator)
|
|
|
|
|
|
|
|
[-] Done |