Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863554501

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: ERPNext 12.29 - Cross-Site Scripting (XSS)
# Date: 7 Feb 2023 
# Exploit Author: Patrick Dean Ramos / Nathu Nandwani / Junnair Manla
#Github - https://github.com/patrickdeanramos/CVE-2022-28598
# Vendor Homepage: https://erpnext.com/
# Version: 12.29
# CVE-2022-28598

Summary: Stored cross-site scripting (XSS) vulnerability was found in ERPNext 12.29 where the 
"last_known_version" field found in the "My Setting" page in ERPNext 
12.29.0 allows remote attackers to inject arbitrary web script or HTML via 
a crafted site name by doing an authenticated POST HTTP request to 
'/desk#Form/User/(Authenticated User)' and inject the script in the 
'last_known_version' field where we are able to view the script by 
clicking the 'pdf' view form.

This vulnerability is specifically the "last_known_version" field found 
under the 'My Settings' where we need to first save the my settings.

1. Login as any user
2. Under the ‘last_known_version’ field we are going to inject our 
malicious script.
3. To view our injected script we need to click the view pdf page, and as 
seen below we have successfully injected our script.