Description
No description provided by source.
{"type": "seebug", "viewCount": 5, "enchantments": {"score": {"value": -0.1, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": -0.1}, "reporter": "Root", "title": "MAARCH 1.4 - SQL Injection", "cvelist": [], "bulletinFamily": "exploit", "sourceHref": "https://www.seebug.org/vuldb/ssvid-87393", "cvss": {"score": 0.0, "vector": "NONE"}, "references": [], "enchantments_done": [], "modified": "2014-11-13T00:00:00", "description": "No description provided by source.", "href": "https://www.seebug.org/vuldb/ssvid-87393", "id": "SSV:87393", "status": "poc", "lastseen": "2017-11-19T13:10:10", "sourceData": "\n /******************************************************\r\n# Exploit Title: Maarch 1.4 SQL Injection \r\n# Google Dork: intext:"Maarch Maerys Archive v2.1 logo"\r\n# Date: 29/10/2014\r\n# Exploit Author: Adrien Thierry\r\n# Exploit Advisory: http://asylum.seraum.com/Security-Alert-GED-ECM-Maarch-Critical-Vulnerabilities.html\r\n# Vendor Homepage: http://maarch.org\r\n# Software Link: http://downloads.sourceforge.net/project/maarch/Maarch%20Entreprise/Maarch-1.4.zip \r\n# Version: Maarch GEC <= 1.4 | Maarch Letterbox <= 2.4\r\n# Tested on: Linux / Windows \r\n******************************************************/\r\n \r\nMaarch GEC <= 1.4 and Maarch Letterbox <= suffer from multiple sql injection vulnerabilities. The worst is at the login page, index.php :\r\n \r\nlogin : superadmin' OR user_id='easy\r\npass : whatyouwant\r\n \r\nYou see an sql error, but reload the web page, you are logged in.\r\n \r\nTo change superadmin pass:\r\n \r\nGo to Menu -> Mon Profile\r\n \r\nType your news password twice, an email etc, and click on save. New Sql error (history table, so we don't care), but password is changed.\r\n \r\nClear your cookies, return to application url, enter your new fresh password, it's done.\n ", "published": "2014-11-13T00:00:00", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645295611, "score": 1659785532, "epss": 1678848988}}
{}
MAARCH 1.4 - SQL Injection