# Exploit Title: OOP CMS BLOG 1.0 - SQL Injection # Exploit Author: Mr Winst0n # Author E-mail: manamtabeshekan[@]gmail[.]com # Discovery Date: March 1, 2019 # Vendor Homepage: http://zsoft.com.bd/ # Software Link : https://datapacket.dl.sourceforge.net/project/php-oop-cms-blog/blog_fo_rup.zip # Tested Version: 1.0 # Tested on: Kali linux, Windows 8.1 # PoC: # Multiple files are vulnerable: # http://localhost/[PATH]/search.php?search=1 [SQLi]&submit=Search # http://localhost/[PATH]/post.php?id=17 [SQLi] # http://localhost/[PATH]/posts.php?id=4 [SQLi] # http://localhost/[PATH]/page.php?pageid=8 [SQLi] # http://localhost/[PATH]/admin/viewUser.php?userid=34 [SQLi] # http://localhost/[PATH]/admin/replayMsg.php?msgid=4 [SQLi] # Note: Above *id values are random. # Exploit Title: OOP CMS BLOG 1.0 - Cross-Site Request Forgery (Delete Admin) # Exploit Author: Mr Winst0n # Author E-mail: manamtabeshekan[@]gmail[.]com # Discovery Date: March 1, 2019 # Vendor Homepage: http://zsoft.com.bd/ # Software Link : https://datapacket.dl.sourceforge.net/project/php-oop-cms-blog/blog_fo_rup.zip # Tested Version: 1.0 # Tested on: Kali linux, Windows 8.1 # PoC:
# Exploit Title: OOP CMS BLOG 1.0 - Cross-Site Request Forgery (Update Site Title and Description) # Exploit Author: Mr Winst0n # Author E-mail: manamtabeshekan[@]gmail[.]com # Discovery Date: March 1, 2019 # Vendor Homepage: http://zsoft.com.bd/ # Software Link : https://datapacket.dl.sourceforge.net/project/php-oop-cms-blog/blog_fo_rup.zip # Tested Version: 1.0 # Tested on: Kali linux, Windows 8.1 # PoC:
# Exploit Title: OOP CMS BLOG 1.0 - Cross-Site Request Forgery (Add Post) # Exploit Author: Mr Winst0n # Author E-mail: manamtabeshekan[@]gmail[.]com # Discovery Date: March 1, 2019 # Vendor Homepage: http://zsoft.com.bd/ # Software Link : https://datapacket.dl.sourceforge.net/project/php-oop-cms-blog/blog_fo_rup.zip # Tested Version: 1.0 # Tested on: Kali linux, Windows 8.1 # PoC:
# Note: Many other sections are vulnerable to CSRF, too. # For example: Delete Post, Add Slider, ...