XODA Document Management System 0.4.5 – Cross-Site Scripting / Arbitrary File Upload

• Exploit Database
• 10 阅读

• 作者： Shai rod
  日期： 2012-08-21
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/20703/

• # Exploit Title: XODA Document Management System Stored XSS & Arbitrary File Upload Vulnerability.
  # Date: 21/08/2012
  # Exploit Author: Shai rod (@NightRang3r)
  # Vendor Homepage: http://xoda.org/
  # Software Link: http://sourceforge.net/projects/xoda/files/xoda/xoda-0.4.5/
  # Version: 0.4.5
   
  #Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar
  
  
  About the Application:
  ======================
  
  XODA targets the end-user allowing organizing of documents in a professional manner.
  
  
  Vulnerability Description
  =========================
  
  1. Arbitrary File Upload:
  
  It is possible to access the file upload page "?upload_to=" without the need to authenticate (log in) to the XODA system.
  An attacker is able to upload a web shell to the server and gain unauzhorized access to the operating system.
  
  Vulnerable URL: http://server/xodadir/?upload_to=
  
  Default location of uploaded files: http://server/xodadir/files/
  
  
  2. Stored XSS in file description.
  
  Steps to reproduce the XSS:
  
  2.1 Select a document.
  2.2 Click on description.
  2.3 Enter XSS Payload: <img src='https://www.exploit-db.com/exploits/20703/1.jpg'onerror=javascript:alert(document.cookie)>
  2.4 Reload the page XSS Should be triggered.
  
  3. Stored XSS in filters.
  
  Steps to reproduce the XSS:
  
  3.1 Select the document.
  3.2 Click on filters.
  3.3 In the "Filters (one per line):" field insert XSS paload: <img src='https://www.exploit-db.com/exploits/20703/1.jpg'onerror=javascript:alert(document.cookie)>
  3.4 Click "Set filters".
  3.5 Click on the document icon to open its properties.
  3.6 XSS Should be triggered.