Advertisement






Soinit Technology Solutions CMS & SQL Vulnerability

CVE Category Price Severity
N/A CWE-89 $500 High
Author Risk Exploitation Type Date
Unknown High Remote 2024-02-18
CPE
cpe:cpe:/a:soinit_technology_solutions:cms
CVSS EPSS EPSSP
CVSS:4.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2024020054

Below is a copy:

Soinit Technology Solutions CMS & SQL Vulnerability
# Exploit Title : Soinit Technology Solutions CMS & SQL Vulnerability
# Discovered By : MrHoudini
# Contact Me : [email protected]
# Date : 14-02-2024
# Vendor : https://soinit-ts.com/
[!] Description.:
SQL injection attacks usually targets database and all of them are the results of programming errors.
If programmer couldn't checked the inputs correctly, so the attacker can send his/her commands to database.
If programmer do this errors at admin page input and the inputs haven't been checked correctly,
occur a very bad thing that allow attacker login to administrator panel
with combination the passwords that turn the result to True in php.
Request Method :
[+] POST
Vulnerable Module:
[+] Login
Vulnerable Parameter:
[+](username) and (Password)
==================================================
[!] Bug.........:
<?php
require_once('any.php');
if($_POST['submit'])
{
$user=$_POST['user'];
$pswd=$_POST['pswd'];
$result=mysql_query("select * from login where user='$user' and pswd='$pswd'");
$rowcount=mysql_num_rows($result);
if($rowcount>0)
{
header('Location:any.php');
}
else
{
echo "bad user";
}
}
?>
==================================================
[!] Live Demo. For Admin Page :
https://makgroupindian.com/admin/
https://firecheckindia.in/admin/
https://soinit-ts.com/admin/

[!] Live Demo. For SQL Injection :
https://www.firecheckindia.in/cms.php?id=4
https://smoceanseafood.com/page.php?id=1

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.