c9576b1787
11 changes to exploits/shellcodes/ghdb LBT-T300-mini1 - Remote Buffer Overflow Nagios XI Version 2024R1.01 - SQL Injection Craft CMS 4.4.14 - Unauthenticated Remote Code Execution Insurance Management System PHP and MySQL 1.0 - Multiple Stored XSS LimeSurvey Community 5.3.32 - Stored XSS MobileShop master v1.0 - SQL Injection Vuln. SPA-CART CMS - Stored XSS Tourism Management System v2.0 - Arbitrary File Upload Wallos < 1.11.2 - File Upload RCE
56 lines
No EOL
1.9 KiB
Text
56 lines
No EOL
1.9 KiB
Text
# Exploit Title: Stored Cross-Site Scripting (XSS) in LimeSurvey Community
|
|
Edition Version 5.3.32+220817
|
|
# Exploit Author: Subhankar Singh
|
|
# Date: 2024-02-03
|
|
# Vendor: LimeSurvey
|
|
# Software Link: https://community.limesurvey.org/releases/
|
|
# Version: LimeSurvey Community Edition Version 5.3.32+220817
|
|
# Tested on: Windows (Client)
|
|
# CVE: CVE-2024-24506
|
|
|
|
## Description:
|
|
|
|
A critical security vulnerability exists in LimeSurvey Community Edition
|
|
Version 5.3.32+220817, particularly in the "General Setting"
|
|
functionality's "Administrator email address:" field. This allows an
|
|
attacker to compromise the super-admin account, leading to potential theft
|
|
of cookies and session tokens.
|
|
|
|
## Background:
|
|
|
|
Cross-site scripting (XSS) is a common web security vulnerability that
|
|
compromises user interactions with a vulnerable application. Stored XSS
|
|
occurs when user input is stored in the application and executed whenever a
|
|
user triggers or visits the page.
|
|
|
|
## Issue:
|
|
|
|
LimeSurvey fails to properly validate user-supplied input on both client
|
|
and server sides, despite some protective measures. The "Administrator
|
|
email address:" field within the "General Setting" functionality permits
|
|
the insertion of special characters, enabling the injection of malicious
|
|
JavaScript payloads. These payloads are stored in the database and executed
|
|
when the user saves or reloads the page.
|
|
|
|
## Steps To Reproduce:
|
|
|
|
1. Log into the LimeSurvey application.
|
|
2. Navigate to the general settings.
|
|
3. Insert the following JavaScript payload in the "Administrator email
|
|
address:" field:
|
|
Payload: `abcxyz@gmail.com"><u>s</u><svg
|
|
onload=confirm(document.domain)>`
|
|
|
|
## Expected Result:
|
|
|
|
The LimeSurvey application should display an alert with the domain after
|
|
clicking save and reloading the page.
|
|
|
|
## Actual Result:
|
|
|
|
The LimeSurvey application is vulnerable to Stored Cross-Site Scripting, as
|
|
evidenced by the successful execution of the injected payload.
|
|
|
|
## Proof of Concept:
|
|
|
|
Attached Screenshots for the reference. |