Multi Language Olx Clone Script - Stored XSS

vendor:

Olx Clone

by:

Varun Bagaria

7.5

CVSS

HIGH

Stored XSS

CWE

Product Name: Olx Clone

Affected Version From: 2.0.6

Affected Version To: 2.0.6

Patch Exists: NO

Related CWE: NA

CPE: a:phpscriptsmall:olx_clone

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 7

2018

Multi Language Olx Clone Script – Stored XSS

A stored XSS vulnerability exists in the Multi Language Olx Clone Script, which allows an attacker to inject malicious JavaScript code into the application. The malicious code is executed when a user visits the vulnerable page. The attack vector is a comment, and the payload is <svg/onload=alert(document.cookie)>. To exploit the vulnerability, an attacker must first register and login to the application, then click on any listing and leave a comment with the malicious payload. The malicious code will then be executed when the page is visited.

Mitigation:

Developers should ensure that user input is properly sanitized and validated before being stored and displayed in the application.

Source

Exploit-DB raw data:

######################################################################################
# Exploit Title: Multi Language Olx Clone Script - Stored XSS
# Date: 08.02.2018
# Exploit Author: Varun Bagaria
# Web:
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/olx-clone/
# Category: Web Application
# Version:2.0.6
# Tested on: Windows 7
# CVE: NA
#######################################################################################

Proof of Concept
=================
URL: https://www.phpscriptsmall.com/product/olx-clone/
Attack Vector : Comment
Payload : <svg/onload=alert(document.cookie)>

Reproduction Steps:
------------------------------
1.Access the above URL
2. Click on "User Demo:
3. Application will be redirected to http://under24usd.com/demo/classi/
4. Goto "Register" and Create a New User
5. Now Login into the application and Click on any :Listing"
6. Click on "Comment" -> "Leave Comment" and inject <svg/onload=alert(document.cookie)>
7. Persistent XSS will be executed.