36 lines
No EOL
2 KiB
Text
36 lines
No EOL
2 KiB
Text
# Exploit Title: Radiant CMS 1.1.3 - Mutiple Persistant XSS Vulnerabilities
|
||
# Exploit Author: David Silveiro
|
||
# Exploit Author Github: github.com/davidsilveiro
|
||
# Exploit Author Twitter: twitter.com/david_silveiro
|
||
# Vendor Homepage: http://radiantcms.org/
|
||
# Software Link: http://radiantcms.org/download/
|
||
# Date: Zero day
|
||
|
||
Radiant is a no-fluff, open source content management system designed for small teams. It is similar to Textpattern or MovableType, but is a general purpose content management system (not just a blogging engine) written in Ruby.
|
||
|
||
Stored XSS 1 – File Title Upload
|
||
|
||
The attacker must first be a user of sorts, as there's only 2 types of roles 'administrator' & 'designer' we're going with the assumption of the latter. Now as the designer we have the option to upload 'assets' such as files or images, here lyes one of the issues.
|
||
|
||
When uploading, we're presented with the option to create a title for an image, which gets displayed back in the general repository where a user logged in as admin would also be able to see it. We're able to input our own javascript within this field, thus when a you then visit the 'assets' page, you will be presented with a pop up.
|
||
|
||
Enter the example below.
|
||
|
||
POC:
|
||
|
||
Title: </script>alert('XSS')</script>
|
||
|
||
|
||
Stored XSS 2 – User Personal Preferences
|
||
|
||
This time round were faced with a lot more avenues to have our JS displayed back to us. Again, we're going with the assumption that we're logged in as a designer user.
|
||
|
||
Let us navigate to the 'Settings page', where you'll see 2 options to edit Personal Preferences & Configuration, click on Edit Prefrences.
|
||
|
||
POC:
|
||
|
||
Name: <script>alert('XSS 1')</script>
|
||
Email Address: <script>alert('XSS2')</script>@gmail.com
|
||
Username: <script>alert('XSS3')</script>
|
||
|
||
This will not only reflect back to you, as the designer, but also the back to the admin when he/she goes onto the http://127.0.0.1/admin/users/ and is presented with our users malicious 'NAME' parameter. |