e8f4ef9188
14 changes to exploits/shellcodes PDFunite 0.41.0 - '.pdf' Local Buffer Overflow RSVG 2.40.13 / 2.42.2 - '.svg' Buffer Overflow VX Search 10.6.18 - 'directory' Local Buffer Overflow Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit) Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit) Easy File Sharing Web Server 7.2 - Stack Buffer Overflow Coship RT3052 Wireless Router - Persistent Cross-Site Scripting Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution MySQL Squid Access Report 2.1.4 - SQL Injection / Cross-Site Scripting Rvsitebuilder CMS - Database Backup Download Match Clone Script 1.0.4 - Cross-Site Scripting Kodi 17.6 - Persistent Cross-Site Scripting Lutron Quantum 2.0 - 3.2.243 - Information Disclosure WordPress Plugin Caldera Forms 1.5.9.1 - Cross-Site Scripting Joomla! Component JS Jobs 1.2.0 - Cross-Site Request Forgery Geist WatchDog Console 3.2.2 - Multiple Vulnerabilities
28 lines
No EOL
1,009 B
Text
28 lines
No EOL
1,009 B
Text
########################################################################
|
|
# Exploit Title: Match Clone Script 1.0.4 - Cross-Site Scripting
|
|
# Date: 23.02.2018
|
|
# Vendor Homepage: https://www.phpscriptsmall.com/
|
|
# Software Link: https://www.phpscriptsmall.com/product/match-clone/
|
|
# Category: Web Application
|
|
# Exploit Author: ManhNho
|
|
# Version: 1.0.4
|
|
# Tested on: Window 10 / Kali Linux
|
|
# CVE: CVE-2018-9857
|
|
##########################################################################
|
|
Description
|
|
------------------------
|
|
PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to
|
|
searchbyid.php (aka the "View Search By Id" screen).
|
|
|
|
Proof of Concept
|
|
------------------------
|
|
1. Access to site
|
|
2. Choose “Search”
|
|
3. Choose "View Search By Id"
|
|
3. Put <script>alert('ManhNho')</script> in search field
|
|
4. You will be having a popup: ManhNho
|
|
|
|
References:
|
|
------------------------
|
|
https://pastebin.com/Y9uEC4nu
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9857 |