EgavilanMedia Address Book 1.0 Exploit – SQLi Auth Bypass

• Exploit Database
• 120 阅读

• 作者： Mayur Parmar
  日期： 2020-12-03
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/49182/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

  # Exploit Title: EgavilanMedia Address Book 1.0 Exploit - SQLi Auth Bypass # Date: 02-12-2020 # Exploit Author: Mayur Parmar(th3cyb3rc0p) # Vendor Homepage: http://egavilanmedia.com # Software Link : http://egavilanmedia.com/egm-address-book/ # Version: 1.0 # Tested on: PopOS   Attack Vector: An attacker can gain admin panel access using malicious sql injection queries.   Steps to reproduce: 1. Open admin login page using following URl: -> http://localhost/Address%20Book/login.php   2. Now put below Payload in both the fields( User ID & Password) Payload: admin' or '1'='1   3. Server accepted our payload and we bypassed cpanel without any credentials