Search for hundreds of thousands of exploits

"Kodi 17.6 - Persistent Cross-Site Scripting"

Author

Exploit author

"Manuel García Cárdenas"

Platform

Exploit platform

multiple

Release date

Exploit published date

2018-04-18

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
=============================================
MGC ALERT 2018-003
- Original release date: March 19, 2018
- Last revised:  April 16, 2018
- Discovered by: Manuel Garcia Cardenas
- Severity: 4,8/10 (CVSS Base Score)
- CVE-ID: CVE-2018-8831
=============================================

I. VULNERABILITY
-------------------------
Kodi <= 17.6 - Persistent Cross-Site Scripting

II. BACKGROUND
-------------------------
Kodi (formerly XBMC) is a free and open-source media player software
application developed by the XBMC Foundation, a non-profit technology
consortium. Kodi is available for multiple operating systems and hardware
platforms, with a software 10-foot user interface for use with televisions
and remote controls.

III. DESCRIPTION
-------------------------
Has been detected a Persistent XSS vulnerability in the web interface of
Kodi, that allows the execution of arbitrary HTML/script code to be
executed in the context of the victim user's browser.

IV. PROOF OF CONCEPT
-------------------------
Go to: Playlist -> Create

Create a playlist injecting javascript code:

<img src=x onerror=alert(1)>

The XSS is executed, in the victim browser.

V. BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted user's
browser, this can leverage to steal sensitive information as user
credentials, personal data, etc.

VI. SYSTEMS AFFECTED
-------------------------
Kodi <= 17.6

VII. SOLUTION
-------------------------
Vendor include the fix:
https://trac.kodi.tv/ticket/17814

VIII. REFERENCES
-------------------------
https://kodi.tv/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel Garcia Cardenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
March 19, 2018 1: Initial release
April 16, 2018 2: Last revision

XI. DISCLOSURE TIMELINE
-------------------------
March 19, 2018 1: Vulnerability acquired by Manuel Garcia Cardenas
March 19, 2018 2: Send to vendor
March 30, 2018 3: Vendo fix
April 16, 2018 4: Sent to lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester
Release DateTitleTypePlatformAuthor
2020-07-07"BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation"webappsmultiple"William Summerhill"
2020-07-06"RSA IG&L Aveksa 7.1.1 - Remote Code Execution"webappsmultiple"Jakub Palaczynski"
2020-07-02"OCS Inventory NG 2.7 - Remote Code Execution"webappsmultipleAskar
2020-06-24"BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting"webappsmultiple"William Summerhill"
2020-06-22"WebPort 1.19.1 - Reflected Cross-Site Scripting"webappsmultiple"Emre ÖVÜNÇ"
2020-06-22"Odoo 12.0 - Local File Inclusion"webappsmultiple"Emre ÖVÜNÇ"
2020-06-22"FileRun 2019.05.21 - Reflected Cross-Site Scripting"webappsmultiple"Emre ÖVÜNÇ"
2020-06-17"OpenCTI 3.3.1 - Directory Traversal"webappsmultiple"Raif Berkay Dincel"
2020-06-15"SOS JobScheduler 1.13.3 - Stored Password Decryption"remotemultiple"Sander Ubink"
2020-06-12"Sysax MultiServer 6.90 - Reflected Cross Site Scripting"webappsmultiple"Luca Epifanio"
Release DateTitleTypePlatformAuthor
2020-05-21"Composr CMS 10.0.30 - Persistent Cross-Site Scripting"webappsphp"Manuel García Cárdenas"
2019-09-13"phpMyAdmin 4.9.0.1 - Cross-Site Request Forgery"webappsphp"Manuel García Cárdenas"
2019-03-13"WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion"webappsphp"Manuel García Cárdenas"
2018-09-19"WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion"webappsphp"Manuel García Cárdenas"
2018-09-19"WordPress Plugin Localize My Post 1.0 - Local File Inclusion"webappsphp"Manuel García Cárdenas"
2018-06-11"WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection"webappsphp"Manuel García Cárdenas"
2018-04-18"Kodi 17.6 - Persistent Cross-Site Scripting"webappsmultiple"Manuel García Cárdenas"
2018-03-12"TextPattern 4.6.2 - 'qty' SQL Injection"webappsphp"Manuel García Cárdenas"
2018-01-12"PyroBatchFTP < 3.19 - Buffer Overflow"doswindows"Manuel García Cárdenas"
2017-12-15"Sync Breeze 10.2.12 - Denial of Service"doswindows"Manuel García Cárdenas"
2017-04-11"WordPress Plugin Spider Event Calendar 1.5.51 - Blind SQL Injection"webappsphp"Manuel García Cárdenas"
2016-09-22"Exponent CMS 2.3.9 - Blind SQL Injection"webappsphp"Manuel García Cárdenas"
2016-04-26"ImpressCMS 1.3.9 - SQL Injection"webappsphp"Manuel García Cárdenas"
2016-02-04"UliCMS v9.8.1 - SQL Injection"webappsphp"Manuel García Cárdenas"
2015-10-06"PHP-Fusion 7.02.07 - Blind SQL Injection"webappsphp"Manuel García Cárdenas"
2014-11-17"WebsiteBaker 2.8.3 - Multiple Vulnerabilities"webappsphp"Manuel García Cárdenas"
2014-11-17"Zoph 0.9.1 - Multiple Vulnerabilities"webappsphp"Manuel García Cárdenas"
2014-11-13"Piwigo 2.6.0 - 'picture.php?rate' SQL Injection"webappsphp"Manuel García Cárdenas"
2013-09-30"XAMPP 1.8.1 - 'lang.php?WriteIntoLocalDisk method' Local Write Access"webappsphp"Manuel García Cárdenas"
2013-06-04"Telaen 2.7.x - Open Redirection"webappsphp"Manuel García Cárdenas"
2013-06-04"Telaen 2.7.x - Cross-Site Scripting"webappsphp"Manuel García Cárdenas"
2013-06-03"Telaen - Information Disclosure"webappsphp"Manuel García Cárdenas"
2013-03-10"Asteriskguru Queue Statistics - 'warning' Cross-Site Scripting"webappsphp"Manuel García Cárdenas"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/44487/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.