CVE-2019-13583

gistfile1.txt

CVE-2019-13583
An issue was discovered in Xtream Codes 1.60.0. It is an XSS chained with 
CSRF, leading to remote command execution as the payload is
stored on a page that is frequently viewed by an admin.

[Additional Information]
A captcha bypass is needed if scripted, a fast function with selenium works well.

The attacker inject the payload which will be reflected in a page.
With social engineering the attacker can push the admin to go to the
page where the payload is reflected, even without social engineering
the page is regularly viewed by an admin. 

Gives admin privileges on
the CMS backend, all the customers usernames & passwords and can be leveraged to a reverse
shell as a sudoer user on the reseller's server.

[VulnerabilityType Other]
Stored XSS chained with a CSRF leading to a RCE

[Vendor of Product]
Xtream-Codes LTD

[Affected Product Code Base]
Xtream-Codes CMS - 1.60

[Affected Component]
Login page

[Attack Type]
Remote

[Impact Code execution]
true

[Impact Escalation of Privileges]
true

[Attack Vectors]
The attacker inject the payload which will be reflected in a page.

[Reference]
https://xtream-codes.com/

[Discoverer]
Coffee & Weed 

Cheers to : KalAp / Adibou