gpEasy CMS Minishop 1.5 Plugin – Persistent Cross-Site Scripting - 体验盒子

作者： Carlos Mario Penagos Hollmann

日期： 2012-07-03

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/19548/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

# Exploit Title: gp easy CMS Minishop 1.5 plugin persistent XSS

# Date: july 2 2012

# Exploit Author: Carlos Mario Penahos Hollmann

# Vendor Homepage:http://gpeasy.com/Download

# Software Link: http://gpeasy.com/Special_Addon_Plugins?cmd=download&id=31

# Version: 1.5

The vulnerable code is in the Minishop 1.5 plugin on the Admin_Minishop.php

, after installing it give to any user right to edit the minishop, then

this user can inject arbitrary javascript code whenusing add product or

add category(both options can trigger the XSS) in the name field typing

As you can see data is not sanitize :)

function AddCategory()

{

require('Language.php');

echo '<b>' . $Mtxt['Add Category'] .'</b><br>';

$ca = & $_REQUEST['cat'];

$cat = $this->my_replace($ca, "no");

$catdes = & $_REQUEST['catdesc'];

$catdesc= $this->my_replace($catdes, "yes");

$Category = $this->GetCategories();

if (empty($cat) )

{

echo '<table class="bordered"><br>';

echo '<th>Category</th><th>Description</th>';

echo '<form action="Admin_Minishop?cmd=addcat"><br>' ;

echo '<tr><td><input type="text" name="cat" size="10" value="'

. $cat . '"></td>';

echo '<td><input type="text" name="catdesc" size="30" value="'

. $catdesc . '"></td></tr>';

echo '<input type="hidden" name="cmd" value="addcat"><br>';

echo '</table><br>';

echo '<input type="submit" value="' . $Mtxt['Add Category'] .

'">';

}

else

{

$Category[$cat] = $catdesc;//echo 'Debug:' .

var_dump($Category) .':';

$this->SaveCategories($Category);

}