The SN News <= 1.2 application is vulnerable to SQL Injection. An attacker can exploit this vulnerability to gain unauthorized access to the application's database.
Exploit for educational purpose only. SuperNews are a brazilian news system in PHP and MySQL. Versions priors to 2.6 have a simple SQL Injection on view news. The developer tried to fix the bug removing keywords like "union" and "select". But, with a recursion, it's possible to bypass this filters. Another SQL Injection on the administration panel: When deleting a post, you can inject SQL for delete all news on the database. Another vulnerability allows to delete files, on the administration panel: When deleting a post, a variable called "unlink" will talk to the system the new's image for delete. But it's possible to delete others files, typing all the file path or using "../".
Taboada Macronews <= 1.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability to gain access to sensitive information stored in the database. The exploit is achieved by sending malicious SQL queries to the vulnerable application. The attacker can use the LOAD_FILE() function to read files from the server.
It exploits one of the several SQL Injections in the system. Specifiedly, in the file 'index.php', parr 'month'.
WespaJuris is a software for law firms. Use this exploit to upload a webshell on vulnerable applications. The exploit works by bypassing the login form with SQLi strings, configuring file formats to add php, adding a new client, adding a new process, adding a new task, adding a new document type and finally uploading the webshell.
WhiteCollarGroup discovered multiple vulnerabilities on TheBlog 2.0, including SQL Injection, XSS Persistent (stored) and Arbitrary File Upload. The exploit is a PoC for SQL Injection on index.php?id=.
We discovered multiple vulnerabilities on the system. SQL Injection, Login bypass, Arbitrary File Upload, Information disclosure and XSS Stored (persistent). The exploit is for a vulnerability in ler.php, but are the same vulnerability on imprimir.php and imagem.php. Usage: php file.php http://server/path/
Mnews <= 1.1 is vulnerable to SQL Injection. An attacker can exploit this vulnerability to gain access to the database and extract sensitive information such as usernames and passwords.
The first vulnerability is in the search form, on index. Paste this in it: %' UNION ALL SELECT 1,group_concat(concat(email,0x3c3d3e,usuario,0x3c3d3e,senha,0x3c3d3e,admin,0x3c3d3e,banido)),3,4,5 from usuarios-- wc. You will get a unique line like: admin@admin.com.br<=>admin<=>e10adc3949ba59abbe56e057f20f883e<=>1<=>0,user@email.com<=>user<=>ee11cbb19052e40b07aac0ca060c23ee<=>1<=>0. Lines are separated by commas (",") and columns, by "<=>". In the return, we have two lines: admin@admin.com.br<=>admin<=>e10adc3949ba59abbe56e057f20f883e<=>1<=>0 user@email.com<=>user<=>ee11cbb19052e40b07aac0ca060c23ee<=>1<=>0. Here, we have the email, username, password (md5) and admin status.
We've found no protection against CSRF (Cross-site Request Forgery), which made possible to do any kind of act on a user (or admin) account. NO FORMS are secured at all. But we've included some interesting examples. These examples execute actions on the user account while he's visiting a special page prepared by us in any other server. He won't know anything while visiting, as nothing is shown. Logging an user off, posting on user's timeline and changing user password are some of the examples.
Services By CQR