ThinkSAAS version 3.7.0 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities.
These vulnerabilities occur due to the lack of proper filtering of input variables in the app/system/action/anti.php file. The vulnerabilities are present in various functionalities such as IP filtering, Email filtering, and Phone number filtering in the admin panel's Security Center, all of which call anti.php.
Details
The application does not properly filter or sanitize user input for variables $ip, $email, and $phone, which are directly stored in the database and displayed in the admin panel. This can lead to stored XSS vulnerabilities. An attacker can exploit these vulnerabilities by injecting malicious JavaScript code into these fields, which will be executed when an admin views these pages.
An attacker can exploit these vulnerabilities using a Cross-Site Request Forgery (CSRF) attack. Below is an example of a PoC for the phone number field:
Summary
ThinkSAAS version 3.7.0 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities. These vulnerabilities occur due to the lack of proper filtering of input variables in the
app/system/action/anti.php
file. The vulnerabilities are present in various functionalities such as IP filtering, Email filtering, and Phone number filtering in the admin panel's Security Center, all of which callanti.php
.Details
The application does not properly filter or sanitize user input for variables
$ip
,$email
, and$phone
, which are directly stored in the database and displayed in the admin panel. This can lead to stored XSS vulnerabilities. An attacker can exploit these vulnerabilities by injecting malicious JavaScript code into these fields, which will be executed when an admin views these pages.IP Filtering
Email Filtering
Phone Number Filtering
Proof of Concept (PoC)
An attacker can exploit these vulnerabilities using a Cross-Site Request Forgery (CSRF) attack. Below is an example of a PoC for the
phone number
field:An attacker can place this PoC on their own website. When an administrator visits this malicious webpage, they unknowingly modify the
$phone
,$email
, or$ip
fields. The next time the administrator views these entries in the backend, the stored XSS payload will be executed. Affected URLs: http://your-ip/index.php?app=system&ac=anti&ts=ip http://your-ip/index.php?app=system&ac=anti&ts=email http://your-ip/index.php?app=system&ac=anti&ts=phone