Under Construction Page with CPanel 1.0 – SQL injection

• Exploit Database
• 116 阅读

• 作者： Mayur Parmar
  日期： 2020-12-02
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/49150/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

  # Exploit Title: Under Construction Page with CPanel 1.0 - SQL injection # Date: 17-11-2020 # Exploit Author: Mayur Parmar(th3cyb3rc0p) # Vendor Homepage: http://egavilanmedia.com # Software Link : http://egavilanmedia.com/under-construction-page-with-cpanel/ # Version: 1.0 # Tested on: PopOS   SQL Injection: SQL injection is a web security vulnerability that allows an attacker to alter the SQL queries made to the database. This can be used to retrieve some sensitive information, like database structure, tables, columns, and their underlying data.   Attack Vector: An attacker can gain admin panel access using malicious sql injection queries.   Steps to reproduce: 1. Open admin login page using following URl: -> http://localhost/Under%20Construction/admin/login.php   2. Now put below Payload in both the fields( User ID & Password) Payload: admin' or '1'='1   3. Server accepted our payload and we bypassed cpanel without any credentials