HomeclosedFAQRegisterLog in

Share | 
 

 VoltEdit CMS SQL Injection Admin Login Bypass & Shell Upload Vulnerability

Go down 
AuthorMessage
V1P3R
WhiteHat Support
WhiteHat Support
avatar

Posts : 76
White Hat Points : 202
White Hat Reputation : 10
Join date : 2013-07-30

PostSubject: VoltEdit CMS SQL Injection Admin Login Bypass & Shell Upload Vulnerability    Tue Aug 20, 2013 8:49 am

================================================================================​==========
VoltEdit CMS SQL Injection Admin Login Bypass & Shell Upload Vulnerability
================================================================================​==========

:----------------------------------------------------------------------------------------------------------------------------------------:
: # Exploit Title : VoltEdit CMS SQL Injection Admin Login Bypass & Shell Upload Vulnerability
: # Date : 18 August 2013
: # Author : X-Cisadane
: # CMS Developer : [You must be registered and logged in to see this link.]
: # Version : ALL
: # Category : Web Applications
: # Vulnerability : SQL Injection Admin Login Bypass & Shell Upload Vulnerability
: # Tested On : Version 26.0.1410.64 m (Windows XP SP 3 32-Bit English)
: # Greetz to : X-Code, Borneo Crew, Depok Cyber, Explore Crew, CodeNesia, Bogor-H, Jakarta Anonymous Club, Jabar Cyber, Winda Utari
:----------------------------------------------------------------------------------------------------------------------------------------:

A multiple vulnerabilities has been identified in "VoltEdit CMS", which could be exploited by attackers to bypass security restrictions into
admin panel. Login input is not well sanitized in admin.php which can lead to to include some specials chars used to change SQL syntax so we
can gain admin access. Successful exploitations allows attacker to access into administrative functions without requiring knowledge of the
password. An attackers while login as admin, may upload PHP Shell (Backdoor) use the document uploader feature.

DORKS (How to find the target) :
================================
intext:VoltEdit cms
inurl:/doing_business_here.php
inurl:/map_room.php
inurl:/colleges_universities.php
Or use your own Google Dorks Smile

Proof of Concept
================

[ 1 ] SQL Injection Admin Login Bypass
Find the target use the dorks above, for example I'm use this dork inurl:/doing_business_here.php
and got the target [You must be registered and logged in to see this link.]
Change the target URL to /admin.php, for example [You must be registered and logged in to see this link.]
After login form appeared, fill the Login ID and Password with '=0#
Gotcha! Pic : [You must be registered and logged in to see this link.]

[ 2 ] Uploading Shell / PHP Backdoor
After login with Administrator Previllege, you can upload PHP Shell
Click Documents menu & Click Choose File
Upload your PHP Shell
Go to [You must be registered and logged in to see this link.] Shell.php


Example of the Vulnerable Sites :
[You must be registered and logged in to see this link.]

_________________
Mess with the Best, Die like the Rest
Back to top Go down
 
VoltEdit CMS SQL Injection Admin Login Bypass & Shell Upload Vulnerability
Back to top 
Page 1 of 1
 Similar topics
-
» vPopulus
» login 3 times only?
» Masalah lampu injection bernyala
» Fantage Admin Question
» April 1st Birthday Greetings!

Permissions in this forum:You cannot reply to topics in this forum
Home of Ethical White Hat Hackers :: White Hat Hackers Community :: Hacking & Security Tutorials-
Jump to: