Exploits / Vulnerability Discovered : 2018-04-10 |
Type : webapps |
Platform : php
This exploit / vulnerability Iscripts easycreate 3.2.1 stored crosssite scripting is for educational purposes only and if it is used you will do on your own risk!
1. Description
====================
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" and "Site Title" fields.
2. PoC
====================
1. from "user section", access to "dashboard" and select "Created from saved items" with edit option
2. In "edit site" action, Inject "><script>alert('2')</script> to "Site Description" field
3. Save and change!! refresh and we have alert pop up!
3. PoC
====================
1. from "user section", access to "dashboard" and select "Created from saved items" with edit option
2. In "edit site" action, Inject </title>"><script>alert('1')</script> to "Site title" field
3. Save and change! refresh and we have alert pop up!