CVE-2023-29489 PoC — Cpanel 跨站脚本漏洞

Source

Associated Vulnerability

Description

This Tool is used to check for CVE-2023-29489 Vulnerability in the provided URL with the set of payloads available

Readme

# Tool-29489

![image](https://github.com/prasad-1808/tool-29489/assets/86564180/747a717a-1691-429b-b2b6-ce3c97b81c51)


# Overview 🔍:
  - This tool is used to identify URLs with CVE-2023-29489 vulnerability.
  - The tool uses payloads to identify the bug.
  - Help menu of tool-29489:
      - `python main.py [help] [URL] [inputfile] [outputfile]`
      -    -h or --help   : To display help options.
      -    -u or --url    : To input URL to check.
      -    -i or --input  : To give the input file.
      -    -o or --output : To give the output file.
   
# About CVE-2023-29489 🔍:
  - CVE Description:-
    - An issue was discovered in cPanel before 11.109.9999.116. Cross-site scripting can occur on the cpsrvd error page via an invalid webcall ID.

  - Description:-
    - Cross-site scripting (also known as XSS) is a web security vulnerability that allows an attacker to compromise users' interactions with a vulnerable application. It allows an attacker to circumvent the same origin policy, which is designed to segregate different websites from each other. Cross-site scripting vulnerabilities normally allow an attacker to masquerade as a victim user, carry out any actions that the user can perform, and access any of the user's data. If the victim user has privileged access within the application, then the attacker might gain full control over all of the application's functionality and data.

   - Reference:-
      - https://forums.cpanel.net/threads/cpanel-tsr-2023-0001-full-disclosure.708949/
      - https://nvd.nist.gov/vuln/detail/CVE-2023-29489
      - https://blog.assetnote.io/2023/04/26/xss-million-websites-cpanel/
   - More Details:
       - KarthiTheHacker
       - GitHub:
           - https://github.com/karthi-the-hacker
           - https://github.com/cappriciosec

# More features:
  - This tool is available in pip for easier access.
  - To install:
      - `pip install -i https://test.pypi.org/simple/ tool-29489==2.0.1`
  - To use tool-29489:
      - `tool-29489 --help`
  - Reference images are attached below:

    ![image](https://github.com/prasad-1808/tool-29489/assets/86564180/dfacdf17-3448-4274-a9da-bf065e5f99ad)

   
# Supported Operating System 🖥️
  <img src="https://knowtive.com/wp-content/uploads/2018/04/windows_10.0.0.jpg" width="150px" height="150px" alt="Windows">   <img src="https://logosmarcas.net/wp-content/uploads/2020/09/Linux-Logo.png" width="150px" height="150px" alt="Linux">   <img src="https://www.kindpng.com/picc/m/172-1724310_mac-os-logo-png-transparent-png.png" width="150px" height="150px" alt="Mac OS">   <img src="https://logodix.com/logo/82913.jpg" width="150px" height="150px" alt="Android Termux">
  
# Tools needed ⚙️
  <img src="https://1.bp.blogspot.com/-X5OBU37Ims4/XQexxebsV0I/AAAAAAAAD80/PlMIGUQBY3YwRugZNLvdRaI2Pw_g0jIlgCLcBGAs/s1600/Python%2BProgramming%2BLogo.png" width="150px" height="150px" alt="Python Programming Language">   <img src="https://www.gitkraken.com/wp-content/uploads/2022/02/CLI-stands-forHero.png" width="200px" height="150px" alt="Command Line Interface">



 <br>
<h2 align="left">Connect with me 📱</h2>
<p align="left">
<a href="https://twitter.com/CyberCheck123" target="blank"><img align="center" src="https://raw.githubusercontent.com/rahuldkjain/github-profile-readme-generator/master/src/images/icons/Social/twitter.svg" alt="Cybercheck Twitter" height="30" width="40" /></a>
<a href="https://www.linkedin.com/in/prasadd08/" target="blank"><img align="center" src="https://raw.githubusercontent.com/rahuldkjain/github-profile-readme-generator/master/src/images/icons/Social/linked-in-alt.svg" alt="Cybercheck Linkedin" height="30" width="40" /></a>
<a href="https://www.instagram.com/cybercheck123/" target="blank"><img align="center" src="https://raw.githubusercontent.com/rahuldkjain/github-profile-readme-generator/master/src/images/icons/Social/instagram.svg" alt="Cybercheck Instagram" height="30" width="40" /></a>
<a href="https://cybercheck123.blogspot.com/" target="blank"><img align="center" src="https://www.logolynx.com/images/logolynx/2c/2c894af7d30a4bd555205cc153382753.png" alt="Cybercheck BlogPage" height="30" width="40" /></a>

  ![](https://komarev.com/ghpvc/?username=prasad-1808)
</p>

File Snapshot

 [4.0K]  /data/pocs/7315c5f4fa67d43b52a587fd01a3e3fd45c1c172
├── [4.1K]  README.md
└── [4.0K]  src
    └── [4.0K]  Tool_29489
        ├── [4.0K]  includes
        │   ├── [ 200]  filereader.py
        │   ├── [ 186]  filewriter.py
        │   ├── [4.0K]  __pycache__
        │   │   ├── [ 489]  filereader.cpython-310.pyc
        │   │   ├── [ 425]  filewriter.cpython-310.pyc
        │   │   └── [ 652]  scan.cpython-310.pyc
        │   └── [ 454]  scan.py
        ├── [   0]  __init__.py
        ├── [  83]  input.txt
        ├── [4.2K]  main.py
        ├── [ 619]  output.txt
        └── [4.0K]  __pycache__
            ├── [ 471]  filereader.cpython-310.pyc
            ├── [ 416]  filewriter.cpython-310.pyc
            ├── [ 930]  main.cpython-310.pyc
            └── [ 634]  scan.cpython-310.pyc

5 directories, 15 files

Remarks