b1f00227f1
12 changes to exploits/shellcodes Free Download Manager 2.0 Built 417 - Local Buffer Overflow (SEH) Allok AVI to DVD SVCD VCD Converter 4.0.1217 - Buffer Overflow (SEH) Eudora Qualcomm WorldMail 9.0.333.0 - IMAPd Service UID Buffer Overflow Shopy Point of Sale v1.0 - CSV Injection Shopy Point of Sale 1.0 - CSV Injection Drupal < 7.58 - 'drupalgeddon3' Authenticated Remote Code Execution (PoC) Blog Master Pro v1.0 - CSV Injection HRSALE The Ultimate HRM v1.0.2 - CSV Injection HRSALE The Ultimate HRM v1.0.2 - 'award_id' SQL Injection Blog Master Pro 1.0 - CSV Injection HRSALE The Ultimate HRM 1.0.2 - CSV Injection HRSALE The Ultimate HRM 1.0.2 - 'award_id' SQL Injection HRSALE The Ultimate HRM v1.0.2 - Local File Inclusion HRSALE The Ultimate HRM 1.0.2 - Local File Inclusion Jfrog Artifactory < 4.16 - Unauthenticated Arbitrary File Upload / Remote Command Execution WordPress Plugin WP with Spritz 1.0 - Remote File Inclusion SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response October CMS User Plugin 1.4.5 - Persistent Cross-Site Scripting MyBB Threads to Link Plugin 1.3 - Cross-Site Scripting GitList 0.6 - Unauthenticated Remote Code Execution TP-Link Technologies TL-WA850RE Wi-Fi Range Extender - Unauthenticated Remote Reboot Frog CMS 0.9.5 - Persistent Cross-Site Scripting
38 lines
No EOL
1.2 KiB
Text
38 lines
No EOL
1.2 KiB
Text
# Exploit Title: Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings
|
|
# Date: 2018-04-23
|
|
# Exploit Author: Wenming Jiang
|
|
# Vendor Homepage: https://github.com/philippe/FrogCMS
|
|
# Software Link: https://github.com/philippe/FrogCMS
|
|
# Version: 0.9.5
|
|
# Tested on: php 5.6, apache2.2.29, macos 10.12.6
|
|
# CVE :CVE-2018-10321
|
|
|
|
|
|
Description:
|
|
Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability when an attacker has access to Settings page, and enters the payload via "Admin Site title" in Settings.
|
|
|
|
|
|
Steps to replicate:
|
|
log into the system as an administrator role;
|
|
enter page: http://your_site/frogcms/admin/?/setting, and click Settings option;
|
|
navigate to "Admin Site title" section
|
|
enter payload as shown in below section:
|
|
Frog CMS1</a><img src=1 onerror="alert()" /><a>
|
|
visit http://your_site/frogcms/admin/?/login, you will triage JavaScript execution
|
|
|
|
|
|
|
|
Exploit Code:
|
|
Frog CMS1</a><img src=1 onerror="alert()" /><a>
|
|
|
|
|
|
Impacts:
|
|
Anyone who visit the target page will be affected to triage JavaScript code, including administrator, editor, developer, and guest.
|
|
|
|
|
|
Affected Version:
|
|
0.9.5
|
|
|
|
|
|
Affected URL:
|
|
http://your_site/frogcms/admin/?/login |