Menu

Search for hundreds of thousands of exploits

"REDCap < 9.1.2 - Cross-Site Scripting"

Author

"Alexandre ZANNI"

Platform

php

Release date

2019-07-19

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
# Exploit Title: REDCap < 9.1.2 - Cross-Site Scripting
# Date: 2019-07-19
# Exploit Author: Dylan GARNAUD & Alexandre ZANNI (https://pwn.by/noraj) - Pentesters from Orange Cyberdefense France
# Vendor Homepage: https://projectredcap.org
# Software Link: https://projectredcap.org
# Version: Redcap 9.x.x before 9.1.2 and 8.x.x before 8.10.2
# Tested on: 9.1.0
# CVE: CVE-2019-13029
# Security advisory: https://gitlab.com/snippets/1874216

### Stored XSS n°1 – Project name (found by Dylan GARNAUD)

Most JavaScript event are blacklisted but not all. As a result we found one event that was not blacklisted and successfully used it.

- Where? In project name
- Payload: `<BODY onKeyPress=alert("xss")>`
- Details: Since it is an *onkeypress* event, it is triggered whenever the user touch any key and since the XSS payload is stored in the project name it appears in several pages.
- Privileges: It requires admin privileges to store it.
- Location example: https://redcap.XXX/redcap/redcap_v9.1.0/ProjectSetup/index.php?pid=16&msg=projectmodified

### Stored XSS n°2 – Calendar (found by Dylan GARNAUD)

- Where? Calendar event
- Payload: `<BODY onKeyPress=alert("xss")>`
- Privileges: It requires admin privileges to store it.
- Location example: https://redcap.XXX/redcap/redcap_v9.1.0/Calendar/index.php?pid=16&view=week&month=7&year=2019&day=12

### Stored XSS n°3 – CSV upload (found by Dylan GARNAUD)

- Where? Wherever there is a CSV upload feature with displayed parsed results
- Payload:
  ```csv
  record_id,my_first_instrument_complete,body_onkeypressalertxssinstrumetn_complete
  <script>alert("upload xss")</script>,,
  ```
- Details: Once the malicious CSV is uploaded, the parsed content is inserted into a HTML table where the XSS will be triggered.
- Privileges: It requires admin privileges to store it.
- URL examples of execution:
  + https://redcap.XXX/redcap/redcap_v9.1.0/index.php?pid=16&route=DataComparisonController:index
  + https://redcap.XXX/redcap/redcap_v9.1.0/DataQuality/index.php?pid=16

### Stored XSS n°4 – Survey queue (found by Alexandre ZANNI)

- Where? In the Survey Queue (choose a Projet > Project Home and Design > Design > Survey Queue)
- Payload: `</textarea><svg/onload='alert("XSS survey queue")'>`
- Privileges: It requires admin privileges to store it.
- Location example: https://redcap.XXX/redcap/redcap_v9.1.0/Design/online_designer.php?pid=16

### Stored XSS n°5 – Survey (found by Alexandre ZANNI)

- Where? In the survey management system.
  + Store: One has to select a project, go in the *Designer* section, choose *Survey Settings* and then store the payload in the WYSIWYG editor section named *Survey Instructions* (the same happens for *Survey Completion Text*).
  + Execute: Anyone who consults the survey, for example https://redcap.XXX/redcap/surveys/?s=88XF8CRJH4, will trigger the XSS.
- Payload:
  ```html
  <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>javascript:alert('Survey XSS')</SCRIPT>"></BODY></HTML>
  ```
- Privileges:
  + Store: It requires admin privileges to store it.
  + Execute: Any unauthenticated user that can consult a survey.
Release Date Title Type Platform Author
2019-08-20 "WordPress Add Mime Types Plugin 2.2.1 - Cross-Site Request Forgery" webapps php "Princy Edward"
2019-08-19 "YouPHPTube 7.2 - 'userCreate.json.php' SQL Injection" webapps php "Fabian Mosch"
2019-08-19 "Neo Billing 3.5 - Persistent Cross-Site Scripting" webapps php n1x_
2019-08-19 "Kimai 2 - Persistent Cross-Site Scripting" webapps php osamaalaa
2019-08-16 "Integria IMS 5.0.86 - Arbitrary File Upload" webapps php Greg.Priest
2019-08-16 "Joomla! component com_jsjobs 1.2.6 - Arbitrary File Deletion" webapps php qw3rTyTy
2019-08-16 "EyesOfNetwork 5.1 - Authenticated Remote Command Execution" webapps php "Nassim Asrir"
2019-08-14 "WordPress Plugin Download Manager 2.5 - Cross-Site Request Forgery" webapps php "Princy Edward"
2019-08-14 "Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'customfields.php' SQL Injection" webapps php qw3rTyTy
2019-08-14 "SugarCRM Enterprise 9.0.0 - Cross-Site Scripting" webapps php "Ilca Lucian Florin"
2019-08-12 "Mitsubishi Electric smartRTU / INEA ME-RTU - Unauthenticated OS Command Injection Bind Shell" webapps php xerubus
2019-08-12 "Mitsubishi Electric smartRTU / INEA ME-RTU - Unauthenticated Configuration Download" webapps php xerubus
2019-08-14 "Agent Tesla Botnet - Arbitrary Code Execution (Metasploit)" remote php "Ege Balci"
2019-08-13 "AZORult Botnet - SQL Injection" remote php prsecurity
2019-08-13 "Agent Tesla Botnet - Arbitrary Code Execution" remote php prsecurity
2019-08-12 "Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'cities.php' SQL Injection" webapps php qw3rTyTy
2019-08-12 "osTicket 1.12 - Persistent Cross-Site Scripting" webapps php "Aishwarya Iyer"
2019-08-12 "osTicket 1.12 - Formula Injection" webapps php "Aishwarya Iyer"
2019-08-12 "osTicket 1.12 - Persistent Cross-Site Scripting via File Upload" webapps php "Aishwarya Iyer"
2019-08-12 "Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticket.php' Arbitrary File Deletion" webapps php qw3rTyTy
2019-08-12 "Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticketreply.php' SQL Injection" webapps php qw3rTyTy
2019-08-12 "UNA 10.0.0 RC1 - 'polyglot.php' Persistent Cross-Site Scripting" webapps php Greg.Priest
2019-08-12 "BSI Advance Hotel Booking System 2.0 - 'booking_details.php Persistent Cross-Site Scripting" webapps php "Angelo Ruwantha"
2019-08-08 "Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 - SQL Injection" webapps php qw3rTyTy
2019-08-08 "Adive Framework 2.0.7 - Cross-Site Request Forgery" webapps php "Pablo Santiago"
2019-08-08 "Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 - Arbitrary File Download" webapps php qw3rTyTy
2019-08-08 "Daily Expense Manager 1.0 - Cross-Site Request Forgery (Delete Income)" webapps php "Mr Winst0n"
2019-08-08 "Open-School 3.0 / Community Edition 2.3 - Cross-Site Scripting" webapps php Greg.Priest
2019-08-08 "Baldr Botnet Panel - Arbitrary Code Execution (Metasploit)" remote php "Ege Balci"
2019-08-07 "WordPress Plugin JoomSport 3.3 - SQL Injection" webapps php "Pablo Santiago"
Release Date Title Type Platform Author
2019-07-19 "REDCap < 9.1.2 - Cross-Site Scripting" webapps php "Alexandre ZANNI"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/47146/?format=json')
                        {"url": "https://www.nmmapper.com/api/exploitdetails/47146/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/47146/41530/redcap-912-cross-site-scripting/download/", "exploit_id": "47146", "exploit_description": "\"REDCap < 9.1.2 - Cross-Site Scripting\"", "exploit_date": "2019-07-19", "exploit_author": "\"Alexandre ZANNI\"", "exploit_type": "webapps", "exploit_platform": "php", "exploit_port": null}
                    

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Browse exploit APIBrowse