LFI to RCE via access_log injection

on
18

How I Buy Free Ticket From 21 Cineplex

on
Hi, it's been a while since my last post.. :)



21 Cineplex is one of the largest group of cinema in Indonesia (Cinema 21, Cinema XXI and The Premiere). In this post i wanna show you guys how i buy ticket using other people account on 21 Cineplex website. Well this is an old vulnerability but they never fix it so let's have some fun. :p

Start with find user cookies and referer link.



I will use this cookies and referer link. Open the referer link in browser.



As we can see on the left side, i don't have access to this account. Now use the user cookies.
I'm using Cookie Injector to write cookies.




Copy and paste user cookies to Cookie Injector than click OK and we'll have this screen below. This means user cookies is written successfully.



Now reopen the referer link. I will automatically login to the user page.



Let's buy a ticket with this account. The account balance is Rp. 165.000.
I wanna watch Inferno :)



Select city, cinema, date, time and how many ticket that we want to buy. Click CONTINUE, select seat and click BUY NOW.




Transaction process.



And i have my free ticket.. :)
I also have the transaction code 11636 to pick up the ticket.



As we can see now the user balance is Rp. 104.000.




Thats it for today. I have movie to watch. :p



Stay safe! Stay cool! :)

Comments

Unknown said…
Information Technology (IT) is a major branch of engineering that has extensive applications in the present world. This field of study focuses on the utilization of computer and telecommunication equipment for storing, retrieving, transmitting and manipulating data. The versatile nature of the subject makes it difficult for IT graduate and postgraduate students to understand the concepts more precisely. As a result, they often struggle with their academic projects. Therefore, seeking IT assignment help in Australia from the best academic experts is a wise option for them.

I am an assignment helper working in an it assignment help Australia company.


October 18, 2018 at 3:49 PM
Kroger Feedback said…
I was able to find good information from your blog articles.

Halfords Give Us A Steer
Subaru Owner's
Bojangles'
February 5, 2019 at 9:08 PM
John Hardy said…
I really like your good work. This article is too informative and very helpful. Keep posting are going to be expecting your next article. Now it's time to avail HALFCASTE CREAM SET for more information.
September 23, 2022 at 2:15 PM
Business-Services said…
This is what latest trend in the world nowadays. Nice and amazing post to read and share. Great to read your articles. Now its time to avail toughened glass shopfronts for more information.
January 20, 2023 at 1:45 PM
Business-Services said…
Finding unique article to comment on is my task. Your way of writing and explaining the topic is great. Keep sharing more articles soon. Now its time to get roller shutter repair london for more information.
January 24, 2023 at 3:08 PM
Max Roy said…
I just want to say thank you for providing us such an informative article. I really appreciate it. Hope you providing us more information through your article in future.
Now it's time to avail taxi milwaukee for more information.
February 24, 2023 at 4:23 PM
Mitchell Jhonson said…
Very detailed information was provided by you on the topic of how to buy free tickets. This article is very helpful for us. I will share this article with my friends. Now it's time to avail Luxury Limo Servcies in Los Angles for more information.
March 29, 2023 at 12:59 PM
Post a Comment