Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863101604

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: MonoCMS Blog 1.0 - Arbitrary File Deletion (Authenticated)
# Date: 2020-09-20
# Exploit Author: Shahrukh Iqbal Mirza (@shahrukhiqbal24)
# Vendor Homepage: https://monocms.com/download
# Software Link: https://monocms.com/download
# Version: 1.0
# Tested On: Windows 10 (XAMPP)
# CVE: N/A

Proof of Concept:
1.	In the upload images page, make a request to delete an already uploaded image. If no image present, upload an image and then make a request to delete that image.
2.	Notice the Request URL
<ip>/base_path_to_cms/uploads?delimg=../../../../../Temp/Copy.txt
This deletes the file ‘copy.txt’ from C:\Temp
3.	Use simple directory traversals to delete arbitrary files.

Note: php files can be unlinked and not deleted.


===========================================================================================================================
###########################################################################################################################
===========================================================================================================================

# Exploit Title: MonoCMS Blog - Account Takeover (CSRF)
# Date: September 29th, 2020
# Exploit Author: Shahrukh Iqbal Mirza (@shahrukhiqbal24)
# Vendor Homepage: https://monocms.com/download
# Software Link: https://monocms.com/download
# Version: 1.0
# Tested On: Windows 10 (XAMPP)
# CVE: CVE-2020-25986


Proof of Concept:
Login using a test user (attacker). Make a password change request, and enter a new password and then intercept the request (in BurpSuite). Generate a CSRF PoC. Save the HTML code in an html file. Login as another user (victim), open the CSRF-PoC html file, and click on submit request. Victim user’s password will be changed.


===========================================================================================================================
###########################################################################################################################
===========================================================================================================================

# Exploit Title: MonoCMS Blog - Sensitive Information Disclosure (Hardcoded Credentials)
# Date: September 29th, 2020
# Exploit Author: Shahrukh Iqbal Mirza (@shahrukhiqbal24)
# Vendor Homepage: https://monocms.com/download
# Software Link: https://monocms.com/download
# Version: 1.0
# Tested On: Windows 10 (XAMPP)
# CVE: CVE-2020-25987


Proof of Concept:
Hard-coded admin and user hashes can be found in the “log.xml” file in the source-code files for MonoCMS Blog. Hash type is bcrypt and hashcat mode 3200 can be used to crack the hash.