Vulners
Lucene search
Ocomon 2.0 - SQL Injection
| Reporter | Title | Published | Views | Family All 7 |
|---|---|---|---|---|
 | Ocomon 2.0 - SQL Injection | 22 Aug 201600:00 | – | zdt |
 | CVE-2005-4664 | 22 Aug 201600:00 | – | circl |
 | CVE-2005-4664 | 16 Jan 200621:00 | – | cve |
 | CVE-2005-4664 | 16 Jan 200621:00 | – | cvelist |
 | EUVD-2005-4658 | 7 Oct 202500:30 | – | euvd |
 | Ocomon 2.0 - SQL Injection | 22 Aug 201600:00 | – | exploitpack |
 | CVE-2005-4664 | 31 Dec 200505:00 | – | nvd |
# Exploit Title: Ocomon 2.0: Acess administrative Bypass / Multiple Sql
Injection
# Google Dork: inurl:ocomon/index.php or intitle:Ocomon 2.0-RC6
# Date: 2016.08.18
# Exploit Author: Jonatas Fil a.k.a pwx
# Vendor Homepage: ninj4c0d3r.github.io
# Version: Latest 2.0RC6
# Tested on: Linux And Windows
# CVE : CVE-2005-4664
\xDetails:
========================================
[Software]
- Ocomon
[Bug Summary]
- Multiple SQL Injection (SQLi)
[Impact]
- High
[Affected Version]
- Latest 2.0RC6
- Prior versions may also be affected
=========================================
\x01- Search by dork in google
Dorks:
inurl:ocomon/index.php or intitle:Ocomon 2.0-RC6
\x02 - After, To find the victim, open the inspect element in admin page.
\x03 - Look for the parameter: <body>: <table>: <tbody>: <tr>, and return
valida() and delete the content, leaving blank.
\x04 - After, Sign in using: "admin'or'" For Username and Password.
\x05 - Finish!, You get acess in administrative page to the system.
--------------------------------------------
\xDEMO:
http://200.66.111.38/ocomon/index.php
http://191.241.229.210:8080/ocomon/index.php
http://191.241.229.210:8081/ocomon/index.php
---------------------------------------------
References:
https://packetstormsecurity.com/files/100568/Ocomon-2.0RC6-SQL-Injection.html
http://www.cvedetails.com/cve/CVE-2005-4664/
https://www.securityfocus.com/bid/15386/exploitData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
22 Aug 2016 00:00Current
6.6Medium risk
Vulners AI Score6.6
CVSS 25
EPSS0.00362