1064b5c455
12 changes to exploits/shellcodes/ghdb Zyxel IKE Packet Decoder - Unauthenticated Remote Code Execution (Metasploit) Rebar3 3.13.2 - Command Injection AEGON LIFE v1.0 Life Insurance Management System - SQL injection vulnerability. AEGON LIFE v1.0 Life Insurance Management System - Stored cross-site scripting (XSS) AEGON LIFE v1.0 Life Insurance Management System - Unauthenticated Remote Code Execution (RCE) Boelter Blue System Management 1.3 - SQL Injection Carbon Forum 5.9.0 - Stored XSS PHP < 8.3.8 - Remote Code Execution (Unauthenticated) (Windows) WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS) (Authenticated) XMB 1.9.12.06 - Stored XSS ZwiiCMS 12.2.04 - Remote Code Execution (Authenticated)
51 lines
No EOL
1.8 KiB
Text
51 lines
No EOL
1.8 KiB
Text
# Exploit Title: Persistent XSS in XMB 1.9.12.06
|
|
# Date: 06/12/2024
|
|
# Exploit Author: Chokri Hammedi
|
|
# Vendor Homepage: https://www.xmbforum2.com/
|
|
# Software Link: https://www.xmbforum2.com/download/XMB-1.9.12.06.zip
|
|
# Version: 1.9.12.06
|
|
# Tested on: Windows XP
|
|
# CVE: N/A
|
|
|
|
## Vulnerability Details
|
|
|
|
A persistent (stored) XSS vulnerability was discovered in XMB 1.9.12.06.
|
|
The vulnerability allows an attacker to inject malicious JavaScript code
|
|
into a template or specific fields. This payload is stored on the server
|
|
and executed in the browser of any user who visits the forum, leading to
|
|
potential session hijacking, data theft, and other malicious activities.
|
|
|
|
### XSS in Template
|
|
|
|
An attacker can inject malicious JavaScript code into a template:
|
|
|
|
1. Login as Admin: Access the XMB Forum with admin privileges.
|
|
2. Navigate to the Administration Panel: Go to `/cp.php`, then in "Look &
|
|
Feel" select "Templates". This will go to `/cp2.php?action=templates`.
|
|
Select the "footer" template and click edit.
|
|
3. Enter Payload: Add the XSS payload in the footer template:
|
|
|
|
|
|
<script>alert('XSS');</script>
|
|
|
|
|
|
4. Save the Change: Click "Submit Changes".
|
|
5. Trigger the Payload: The XSS payload will trigger anywhere the footer
|
|
template is rendered.
|
|
|
|
### XSS in News Ticker
|
|
|
|
An attacker can inject malicious JavaScript code into the News Ticker field
|
|
of the Front Page Options:
|
|
|
|
1. Login as Admin: Access the XMB Forum with admin privileges.
|
|
2. Navigate to the Administration Panel: Go to `/cp.php`, then in
|
|
"Settings" go to "Front Page Options".
|
|
3. Enter Payload: Add the XSS payload in the "News in Newsticker" field:
|
|
|
|
<img src=x onerror=alert(1)>
|
|
|
|
|
|
4. Save the Change: Click "Submit Changes".
|
|
5. Trigger the Payload: The XSS payload will trigger anywhere the News
|
|
Ticker is displayed eg, home page |