OpenCart 跨站脚本漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1704327 漏洞类型 跨站脚本
发布时间 2019-09-03 更新时间 2019-09-03
CVE编号 CVE-2019-15081 CNNVD-ID CNNVD-201908-1107
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2019090017
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201908-1107
|漏洞详情
OpenCart是中国香港OpenCart公司的一套开源的电子商务系统。该系统提供产品评论、产品评分、产品添加等模块。 OpenCart 3.x版本中的Categories Product和Information页面存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。
|漏洞EXP
# Exploit Title: Opencart 3.x.x Authenticated Stored XSS
# Date: 08/15/2019
# Exploit Author: Nipun Somani
# Author Web: http://thehackerstore.net
# Vendor Homepage: https://www.opencart.com/
# Software Link: https://github.com/opencart/opencart
# Version: 3.x.x
# Tested on: Debian 9, Windows 10 x64
# CVE : CVE-2019-15081


Description:
The Opencart Version 3.x.x allows editing Source/HTML of the Categories /
Product / Information pages in the admin panel which isn't sanitized to
user input allowing for an attacker to execute arbitrary javascript code
leading to Stored Cross-Site-Scripting(XSS).

Proof-of-Concept(POC):

1. Log-in to admin-panel.
2. Navigate to Catlog and then select any of [Categories or Products or Information] options and and pick any entry or create one.
3. Under description click on Source option and insert your XSS payload.
i.e: "><script>alert("XSS")</script>
4. Now visit the modified page of your public website. And your injected XSS payload will execute.
|参考资料

来源:github.com

链接:https://github.com/nipunsomani/Opencart-3.x.x-Authenticated-Stored-XSS/blob/master/README.md


来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2019-15081