CVE-2023-46003 PoC — I-doit pro 跨站脚本漏洞

介绍

# CVE-2023-46003 (Stored XSS in i-doit Pro 25 and below)


i-doit Pro 25 and below are vulnerable to Stored XSS vulnerability. These could allows remote authenticated attackers (low or high privilege) to stores dangerous data (xss payload or fake html page) in a database, it will be trigger the xss payload when the webpage is loaded.


Description of product: i-doit is a web based IT documentation and CMDB (Configuration Management Database) developed by synetics GmbH , i-doit Pro is the commercial version of the software and requires a paid license. It comes with additional features, professional support, and regular updates and enhancements. Users need to purchase a license to use i-doit Pro, and the cost varies based on the number of users and features required.


Description of vulnerability: We found that this web application allows any authenticated user to stores dangerous data (xss payload or fake html page) in a database, it will be trigged when the webpage is load.



Affected Webpage: /?moduleID and /index.php

Affected Parameters & Components  : 'Title' , 'SYSID prefix' , 'Language content' , 'Automatic Inventory number' , 'objectTitle' , 'Description'

Note: the affected parameters has acknowleged by developers as there are more than 20 parameters in total.


Affected Components  : Dashboard


![step1](https://github.com/leekenghwa/CVE-2023-46003/assets/45155253/03680fd3-b949-4572-bc54-30523495f7f6)


![step2](https://github.com/leekenghwa/CVE-2023-46003/assets/45155253/3bc61ef3-6468-421a-9c8f-0883089628a4)

create new object

![step3](https://github.com/leekenghwa/CVE-2023-46003/assets/45155253/0b507f10-00c8-41db-9bf1-7e0351b83700)

insert the xss payload or fake html page to trick users.


![step4](https://github.com/leekenghwa/CVE-2023-46003/assets/45155253/f20d39dc-8b0c-4314-9e59-bf82d945a629)

after save, the payload can be trigger when the webpage is loaded.

![step5](https://github.com/leekenghwa/CVE-2023-46003/assets/45155253/7cf4fd0b-f49c-4166-8afc-fd7a2188de77)






Affected Components  : Software


![Lei_SC](https://github.com/leekenghwa/CVE-2023-46003/assets/45155253/5d56f6bc-e89c-44ba-9c5b-d19d9636869c)

![Lei_SC_1](https://github.com/leekenghwa/CVE-2023-46003/assets/45155253/ec018e20-e399-4bf8-82ea-902d378878fe)


Affected Components  : Extras

![step 1](https://github.com/leekenghwa/CVE-2023-46003/assets/45155253/adf29bde-2f6e-4a4b-9e01-53e6fec7daa3)


![step2](https://github.com/leekenghwa/CVE-2023-46003/assets/45155253/b80bce15-6f0e-4762-b339-7b317640bb25)

![step3](https://github.com/leekenghwa/CVE-2023-46003/assets/45155253/57b0a28e-347e-4f4d-a345-28ee04ae651d)

Inset the XSS payload or fake webpage

![steo4](https://github.com/leekenghwa/CVE-2023-46003/assets/45155253/295fb983-bee8-4c1c-b60b-e96a57249263)


![step5](https://github.com/leekenghwa/CVE-2023-46003/assets/45155253/a4242454-d722-47b4-865f-2966c8fc4984)

![step6](https://github.com/leekenghwa/CVE-2023-46003/assets/45155253/d8603113-aec1-4938-a6de-ef2825679b25)

文件快照

备注