| 标题 | The Next Generation of Genealogy Sitebuilding SQL Injection Vulnerability |
|---|
| 描述 | ==========================================================================================
The Next Generation of Genealogy Sitebuilding SQL Injection Vulnerability
==========================================================================================
:-------------------------------------------------------------------------------------------------------------------------:
: # Exploit Title : The Next Generation of Genealogy Sitebuilding SQL Injection Vulnerability
: # Date : 29th August 2017
: # Author : X-Cisadane
: # CMS Name : The Next Generation of Genealogy Sitebuilding
: # Version : < 11.1.1
: # CMS Developer : http://www.tngsitebuilding.com/
: # Category : Web Application
: # Vulnerability : SQL Injection
: # Tested On : SQLMap x.x.x.x#dev (Windows 7 64-bit)
: # Greetz to : X-Code YogyaFree, ExploreCrew, CodeNesia, Bogor Hackers Community, Borneo Crew, Depok Cyber, Mantan
:-------------------------------------------------------------------------------------------------------------------------:
A SQL Injection Vulnerability has been discovered in the The Next Generation of Genealogy Sitebuilding CMS.
The vulnerability allows remote attackers to execute own SQL Commands by usage of a vulnerable serivce value.
The vulnerability is located in the primaryID value of the timeline2.php file.
Remote attackers are able to execute own SQL Commands by usage of a GET method request with manipulated primaryID value.
Remote attackers are able to read database information by execution of own SQL Commands.
DORKS (How to find the target) :
================================
inurl:/timeline2.php?primaryID=
Or "powered by The Next Generation of Genealogy Sitebuilding"
Or use your own Google Dorks :)
Proof of Concept
================
SQL Injection
PoC :
http://[Site]/[Path]/timeline2.php?primaryID=['SQLi]
Screenshot (PoC) :
https://s20.postimg.org/asdu29rwt/Screenshot_99.png
https://s20.postimg.org/wsu6iwakt/Screenshot_100.png
Example of Vuln Sites :
http://1820settlers.co.uk/genealogy/timeline2.php?primaryID=['SQLi]
http://lythgoes.net/genealogy/timeline2.php?primaryID=['SQLi]
http://henrygrowfamily.org/timeline2.php?primaryID=['SQLi]
http://www.ennever.com/timeline2.php?primaryID=['SQLi]
http://mcbridehistory.com/timeline2.php?primaryID=['SQLi]
... etc ... |
|---|
| 来源 | ⚠️ http://1820settlers.co.uk/genealogy/timeline2.php?primaryID=%27I5880&tree=master&chartwidth= |
|---|
| 用户 | X-Cisadane (UID 172) |
|---|
| 提交 | 2017-08-29 04時36分 (9 年前) |
|---|
| 管理 | 2017-08-29 11時33分 (7 hours later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 105833 [The Next Generation of Genealogy Sitebuilding 直到 11.1.0 /timeline2.php primaryID SQL注入] |
|---|
| 积分 | 20 |
|---|