Search for hundreds of thousands of exploits

"AMSS++ v 4.31 - 'id' SQL Injection"

Author

Exploit author

indoushka

Platform

Exploit platform

php

Release date

Exploit published date

2020-02-24

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
# Title : AMSS++ v 4.31 - 'id' SQL Injection
# Author : indoushka
# Tested on: windows 10 Français V.(Pro) / browser : Mozilla firefox 65.0(32-bit) 
# Vendor: http://amssplus.ubn4.go.th/amssplus_download/amssplus_4_31_install.rar  
# Dork: แนะนำให้ใช้บราวเซอร์ Google Chrome "AMSS++"
# CVE: N/A

# poc :

[+] Dorking İn Google Or Other Search Enggine.

[+] Use payload : /modules/mail/main/maildetail.php?id=174

[+] http://127.0.0.1/amssplus_4_31_install/amssplus/modules/mail/main/maildetail.php?id=1 <==== inject here


Greetings to :=========================================================================================================================
                                                                                                                                      |
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm*                                            |        
                                                                                                                                      |
=======================================================================================================================================
Release DateTitleTypePlatformAuthor
2020-05-29"Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass"webappsmultiple"Halis Duraki"
2020-05-29"WordPress Plugin Multi-Scheduler 1.0.0 - Cross-Site Request Forgery (Delete User)"webappsphpUnD3sc0n0c1d0
2020-05-28"EyouCMS 1.4.6 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-28"NOKIA VitalSuite SPM 2020 - 'UserName' SQL Injection"webappsmultiple"Berk Dusunur"
2020-05-28"QNAP QTS and Photo Station 6.0.3 - Remote Command Execution"webappsphpTh3GundY
2020-05-28"Online-Exam-System 2015 - 'fid' SQL Injection"webappsphp"Berk Dusunur"
2020-05-27"LimeSurvey 4.1.11 - 'Permission Roles' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
2020-05-27"osTicket 1.14.1 - 'Saved Search' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
2020-05-27"Kuicms PHP EE 2.0 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-27"Online Marriage Registration System 1.0 - Persistent Cross-Site Scripting"webappsphp"that faceless coder"
Release DateTitleTypePlatformAuthor
2020-05-29"WordPress Plugin Multi-Scheduler 1.0.0 - Cross-Site Request Forgery (Delete User)"webappsphpUnD3sc0n0c1d0
2020-05-28"QNAP QTS and Photo Station 6.0.3 - Remote Command Execution"webappsphpTh3GundY
2020-05-28"Online-Exam-System 2015 - 'fid' SQL Injection"webappsphp"Berk Dusunur"
2020-05-28"EyouCMS 1.4.6 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-27"Kuicms PHP EE 2.0 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-27"osTicket 1.14.1 - 'Saved Search' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
2020-05-27"OXID eShop 6.3.4 - 'sorting' SQL Injection"webappsphpVulnSpy
2020-05-27"LimeSurvey 4.1.11 - 'Permission Roles' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
2020-05-27"Online Marriage Registration System 1.0 - Persistent Cross-Site Scripting"webappsphp"that faceless coder"
2020-05-27"osTicket 1.14.1 - 'Ticket Queue' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
Release DateTitleTypePlatformAuthor
2020-02-26"PhpIX 2012 Professional - 'id' SQL Injection"webappsphpindoushka
2020-02-24"AMSS++ 4.7 - Backdoor Admin Account"webappsphpindoushka
2020-02-24"AMSS++ v 4.31 - 'id' SQL Injection"webappsphpindoushka
2020-02-20"Easy2Pilot 7 - Cross-Site Request Forgery (Add User)"webappsphpindoushka
2014-05-08"CMS Touch - 'news.php?News_ID' SQL Injection"webappsphpindoushka
2014-05-08"CMS Touch - 'pages.php?Page_ID' SQL Injection"webappsphpindoushka
2014-05-05"PrestaShop - 'getSimilarManufacturer.php?id_manufacturer' SQL Injection"webappsphpindoushka
2014-03-17"OpenSupports 2.0 - Blind SQL Injection"webappsphpindoushka
2013-07-06"phpVibe 3.1 - Information Disclosure / Remote File Inclusion"webappsphpindoushka
2012-06-19"AdaptCMS 2.0.2 - 'index.php' Script Cross-Site Scripting"webappsphpindoushka
2012-04-17"Joomla! Component JA T3 Framework - Directory Traversal"webappsphpindoushka
2012-02-13"Powie pFile 1.02 - '/pfile/kommentar.php?filecat' Cross-Site Scripting"webappsphpindoushka
2012-02-13"Powie pFile 1.02 - '/pfile/file.php?id' SQL Injection"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_stat_alerts.php?base_path' Remote File Inclusion"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_stat_ports.php?base_path' Remote File Inclusion"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_stat_time.php?base_path' Remote File Inclusion"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_stat_common.php?base_path' Remote File Inclusion"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_stat_class.php?base_path' Remote File Inclusion"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_qry_common.php?base_path' Remote File Inclusion"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_ag_main.php' Crafted Arbitrary File Upload / Arbitrary Code Execution"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_stat_sensor.php?base_path' Remote File Inclusion"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_user.php?base_path' Remote File Inclusion"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_stat_iplink.php?base_path' Remote File Inclusion"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_qry_alert.php?base_path' Remote File Inclusion"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - '/admin/base_useradmin.php?base_path' Remote File Inclusion"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - 'index.php?base_path' Remote File Inclusion"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_stat_uaddr.php?base_path' Remote File Inclusion"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - '/admin/index.php?base_path' Remote File Inclusion"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_stat_ipaddr.php?base_path' Remote File Inclusion"webappsphpindoushka
2012-02-11"Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_ag_main.php?base_path' Remote File Inclusion"webappsphpindoushka
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/48109/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.