PayuKart Multivendor Products Marketplace v3.0 WebShell Upload & Stored XSS Injection

2019.04.19
ru QUIXSS (RU) ru
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

[+] :: Title: PayuKart Multivendor Products Marketplace v3.0 WebShell Upload & Stored XSS Injection [+] :: Author: QUIXSS [+] :: Date: 2019-04-19 [+] :: Software: PayuKart Multivendor Products Marketplace v3.0 [+] :: Technical Details & Description: # Weak security measures like bad input fields data filtering and no restriction for .PHP5/.PHP7 file upload has been discovered in the «PayuKart Multivendor Products Marketplace». Current version of this web-application is 3.0. [+] :: Demo Website: # https://codecanyon.net/item/payukart-multivendor-products-marketplace/21810581 # Frontend: http://fluxkart.com/payukart # Backend: http://fluxkart.com/payukart/login # Login: admin, Password: admin [+] :: Special Note: # Author of this web-application was warned about bad security measures. Nothing has changed. [+] :: PoC Upload: # http://fluxkart.com/payukart/local/images/media/15556222204009.php # http://fluxkart.com/payukart/local/app/Http/Controllers/SystemController.php?cmd=ls%20-la [+] :: PoC #1 [WebShell Upload]: # Authorize on the demo website for tests: http://fluxkart.com/payukart/login (login & password is admin). Then go to the settings page: http://fluxkart.com/payukart/admin/settings # Vulnerable file upload fields is «Logo» and «Animated Gif Image». You can upload any .PHP file u want, just change file type from .PHP to .PHP7 (cuz PHP v7.X is enabled on this server). Next step is to submit this form, but by default author disabled it by using special class and attribute «disabled». It's easy to bypass: «inspect» this button in the Developers Console, edit code as HTML and delete class «btndisable», then change type attribute from «button» to «submit». At the end of this trick you must see this code: <button type="submit" class="btn btn-success">Submit</button>. That's it! Submit the form and your uploaded .PHP7 file will be here: http://fluxkart.com/payukart/local/images/media/XXXXX.php7 (or u can «inspect» broken image to get the link). [+] :: PoC #2 [Stored XSS Injection]: # Authorize on the demo website for tests: http://fluxkart.com/payukart/login (login & password is admin). Then go to the settings page: http://fluxkart.com/payukart/admin/settings # Almost each input field is vulnerable for Stored XSS Injections.

References:

https://codecanyon.net/item/payukart-multivendor-products-marketplace/21810581


Vote for this issue:
100%
0%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top