076ef173f9
23 new exploits Poison Ivy 2.1.x C2 Buffer Overflow (msf) Matrix42 Remote Control Host 3.20.0031 - Unquoted Path Privilege Escalation Dell OpenManage Server Administrator 8.3 - XML External Entity Exploit Mobiketa 1.0 - CSRF Add Admin Exploit miniMySQLAdmin 1.1.3 - CSRF Execute SQL Query phpMyFAQ 2.9.0 - Stored XSS Windows x86 system(_systeminfo_) Shellcode Armadito Antimalware - Backdoor/Bypass Riot Games League of Legends - Insecure File Permissions Privilege Escalation IPFire proxy.cgi RCE IPFire Bash Environment Variable Injection (Shellshock) Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution OS X Kernel - Exploitable NULL Pointer Dereference in nvCommandQueue::GetHandleIndex in GeForce.kext Android - /system/bin/sdcard Stack Buffer Overflow OS X Kernel - Exploitable NULL Pointer Dereference in AppleMuxControl.kext OS X Kernel - Exploitable NULL Pointer Dereference in AppleGraphicsDeviceControl OS X Kernel - Exploitable NULL Dereference in IOAccelSharedUserClient2::page_off_resource OS X Kernel - Exploitable NULL Dereference in CoreCaptureResponder Due to Unchecked Return Value OS X Kernel - Exploitable NULL Pointer Dereference in IOAudioEngine OS X Kernel - OOB Read of Object Pointer Due to Insufficient Checks in Raw Cast to enum Type OS X Kernel - Use-After-Free Due to Bad Locking in IOAcceleratorFamily2 OS X/iOS Kernel - UAF Racing getProperty on IOHDIXController and testNetBootMethod on IOHDIXControllerUserClient OS X Kernel - Stack Buffer Overflow in GeForce GPU Driver
31 lines
No EOL
979 B
Text
Executable file
31 lines
No EOL
979 B
Text
Executable file
# Exploit Title: phpMyFAQ 2.9.0 Stored XSS
|
||
# Date: 09-06-2016
|
||
# Software Link: http://www.phpmyfaq.de/
|
||
# Exploit Author: Kacper Szurek
|
||
# Contact: http://twitter.com/KacperSzurek
|
||
# Website: http://security.szurek.pl/
|
||
# Category: webapps
|
||
|
||
1. Description
|
||
|
||
PHP `filter_input()` function with `FILTER_VALIDATE_URL` flag is used to validate url inside `savefaq` functionality.
|
||
|
||
But this function doesn’t protect against XSS.
|
||
|
||
http://security.szurek.pl/phpmyfaq-290-stored-xss.html
|
||
|
||
2. Proof of Concept
|
||
|
||
By default every user can propose faq entries.
|
||
|
||
When admin activate article using http://phpmyfaq/admin/?action=view url or records.defaultActivation option is enabled, XSS will be visible on entry page:
|
||
|
||
http://phpmyfaq/index.php?action=artikel&cat=%cat_id%&id=%article_id%&artlang=pl
|
||
|
||
For exploitation use folowing url inside Link for this FAQ field:
|
||
|
||
http://example.com/"><script>alert("xss")</script>
|
||
|
||
3. Solution:
|
||
|
||
Update to version 2.9.1 |