XODA Document Management System 0.4.5 – Cross-Site Scripting / Arbitrary File Upload

• Exploit Database
• 94 阅读

• 作者： Shai rod
  日期： 2012-08-21
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/20703/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49

  # Exploit Title: XODA Document Management System Stored XSS & Arbitrary File Upload Vulnerability. # Date: 21/08/2012 # Exploit Author: Shai rod (@NightRang3r) # Vendor Homepage: http://xoda.org/ # Software Link: http://sourceforge.net/projects/xoda/files/xoda/xoda-0.4.5/ # Version: 0.4.5 #Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar     About the Application: ======================   XODA targets the end-user allowing organizing of documents in a professional manner.     Vulnerability Description =========================   1. Arbitrary File Upload:   It is possible to access the file upload page "?upload_to=" without the need to authenticate (log in) to the XODA system. An attacker is able to upload a web shell to the server and gain unauzhorized access to the operating system.   Vulnerable URL: http://server/xodadir/?upload_to=   Default location of uploaded files: http://server/xodadir/files/     2. Stored XSS in file description.   Steps to reproduce the XSS:   2.1 Select a document. 2.2 Click on description. 2.3 Enter XSS Payload: <img src=&apos;https://www.exploit-db.com/exploits/20703/1.jpg&apos;onerror=javascript:alert(document.cookie)> 2.4 Reload the page XSS Should be triggered.   3. Stored XSS in filters.   Steps to reproduce the XSS:   3.1 Select the document. 3.2 Click on filters. 3.3 In the "Filters (one per line):" field insert XSS paload: <img src=&apos;https://www.exploit-db.com/exploits/20703/1.jpg&apos;onerror=javascript:alert(document.cookie)> 3.4 Click "Set filters". 3.5 Click on the document icon to open its properties. 3.6 XSS Should be triggered.