Sploitus

Exploit for CVE-2023-49976

kitploit Β· 2026-08-31

Exploit Code

MARKDOWN36 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-GERALDOALCANTARA-CVE-2023-49976
# CVE-2023-49976

# Customer Support System 1.0 - (XSS) Cross-Site Scripting 취약점 - "subject" ν•„λ“œ("ticket_list" νŽ˜μ΄μ§€)

**μ„€λͺ…** : Customer Support System 1.0은 μ €μž₯ν˜• XSS에 μ·¨μ•½ν•©λ‹ˆλ‹€. Customer Support System 버전 1에 XSS 취약점이 μ‘΄μž¬ν•©λ‹ˆλ‹€. μ•…μ˜μ μΈ μ‚¬μš©μžκ°€ 티켓을 νŽΈμ§‘/생성할 λ•Œ "subject" ν•„λ“œλ₯Ό 톡해 JavaScript μ½”λ“œλ₯Ό μ‚½μž…ν•  수 μžˆμŠ΅λ‹ˆλ‹€. 이 μ½”λ“œλŠ” "/customer_support/index.php?page=ticket_list" νŽ˜μ΄μ§€μ— 접속할 λ•Œλ§ˆλ‹€ μ‹€ν–‰λ©λ‹ˆλ‹€.

**μ·¨μ•½ν•œ μ œν’ˆ 버전** : Customer Support System 1.0  
**CVE μž‘μ„±μž** : Geraldo AlcΓ’ntara  
**λ‚ μ§œ** : 28/11/2023  
**확인 λ‚ μ§œ** : 19/12/2023  
**CVE** : CVE-2023-49976  
**ν…ŒμŠ€νŠΈ ν™˜κ²½** : Windows

### μž¬ν˜„ 단계:

  1. μ• ν”Œλ¦¬μΌ€μ΄μ…˜μ— λ‘œκ·ΈμΈν•©λ‹ˆλ‹€.
  2. ν‹°μΌ“ 생성/νŽΈμ§‘ νŽ˜μ΄μ§€λ₯Ό λ°©λ¬Έν•©λ‹ˆλ‹€.
  3. 티켓을 생성/νŽΈμ§‘ν•˜κ³  "subject" ν•„λ“œ/νŒŒλΌλ―Έν„°μ— μ•…μ„± νŽ˜μ΄λ‘œλ“œλ₯Ό μ‚½μž…ν•©λ‹ˆλ‹€.
  4. νŽ˜μ΄λ‘œλ“œ:



root@kitploit:~
    
    
    <dt/><b/><script>alert(document.domain)</script>
    

티켓을 μ €μž₯ν•˜κ³  νŽ˜μ΄λ‘œλ“œλ₯Ό μ£Όμž…ν•©λ‹ˆλ‹€.

![xss01](https://assets.kitploit.com/production/public/readmes/25818/7aa779e274a3b4c2090a1ebc431f528e936bac19668d25b6dd5af858c3871527.png)

ν‹°μΌ“ λͺ©λ‘ νŽ˜μ΄μ§€μ— λ°©λ¬Έν•˜λ©΄ 곡격이 μ„±κ³΅μ μœΌλ‘œ μ‹€ν–‰λ©λ‹ˆλ‹€.

![xss03](https://assets.kitploit.com/production/public/readmes/25818/fbd74885d92ca7d959a2444930b4dc6360607a236f369f2ac04b566fe139851c.png) ![xss03](https://assets.kitploit.com/production/public/readmes/25818/f8e9dfea9e79f6f5178fb733546ec160fe440f5eb271ff7c5d42088a8b9383d2.png)