iMLog < 1.307 Persistent Cross Site Scripting (XSS)

2024.07.16
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

# Exploit Title: iMLog < 1.307 - Persistent Cross Site Scripting (XSS) # Date: 22/5/2024 # Exploit Author: Gabriel Felipe # Vendor Homepage: https://itssglobal.com # Software Link: https://itssglobal.com/index.php/imlog/ # Version: 1.307 # Tested on: Firefox and Chrome Browsers # Patched Version: 1.308 # Category: Web Application # PoC: iMLog < 1.307 is vulnerable to persistent cross-site scripting (XSS) via the "User Management" feature. An attacker could inject malicious javascript code on a controlled user so when an admin goes to the "User Maintenance" malicious code is executed and could lead to new admin user creations resulting in privilege escalation. 1. Login to user account 2. Go to Setup > "User Maintenance" 3. Click on "Search" and then select your UserID. 4. Change the "Last Name" input to `<img/src/onerror=prompt('XSS')>` 5. Click on "Save" 6. Refresh the page, XSS will be triggered.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top